test(repo): root hermeticity rides test.projects, not the deprecated workspace file [NOT guard-accepted]

r1's B15 finding: vitest.workspace.ts is deprecated and stops being read at
vitest 4 — the guarantee would silently expire, reopening the unguarded
root-invocation hole in exactly the way that cost the QA cycle. Same seven
lines as a root vitest.config.ts test.projects entry, which the next major
keeps reading. Replayed the root invocation: 14/14 through the package
config, no deprecation warning.

Claude-Session: https://claude.ai/code/session_01DWhNDDavuNoFWK8ZrYtSdH
(cherry picked from commit 711500ef6a815d344d7b5658215bdd2b57f671c8)
(cherry picked from commit fbe88fb93621e2698a1125e4c9e02a4322671328)

vitest.config.ts

@@ -0,0 +1,16 @@
+// B15 — root-invocation hermeticity (r1-reviewed shape: test.projects, NOT the deprecated
+// workspace file). The per-package vitest configs carry the hermetic-env setup (D12: scrub
+// connection env, fixture-scoped OPENRIG_HOME, fetch guard), but a bare
+// `npx vitest run packages/cli/test/x.test.ts` from the REPO ROOT found no config and ran
+// UNGUARDED — inside a seat that meant the suites escaped their mocks to the live daemon and
+// produced 13 false failures that cost a QA cycle and a dispatched work item (B15). This root
+// config makes the root invocation resolve each package's own config, so the guarantee genuinely
+// "lives where it cannot be skipped" — and on a carrier vitest will keep reading past v4 (the
+// workspace-file variant was deprecated and would have silently reopened the hole at the upgrade).
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    projects: ["packages/*/vitest.config.ts"],
+  },
+});

vitest.workspace.ts

@@ -1,7 +0,0 @@
-// B15 — root-invocation hermeticity. The per-package vitest configs carry the hermetic-env setup
-// (D12: scrub connection env, fixture-scoped OPENRIG_HOME, fetch guard), but a bare `npx vitest run
-// packages/cli/test/x.test.ts` from the REPO ROOT found no config and ran UNGUARDED — inside a seat
-// that meant the suites escaped their mocks to the live daemon and produced 13 false failures that
-// cost a QA cycle and a dispatched work item (B15). This workspace file makes the root invocation
-// resolve each package's own config, so the guarantee genuinely "lives where it cannot be skipped".
-export default ["packages/*/vitest.config.ts"];