fix: tests depended on ambient CONTEXT7_API_KEY, broke in CI

\`lh doctor\`'s context7 check is a required, env-only check by design
(ADR: never inferred, never persisted). Tests that shell out to \`lh\`
or \`scripts/onboard.mjs\` inherited whatever CONTEXT7_API_KEY the
developer's shell happened to export, so \`doctor passes once the repo
is initialised\` and the onboard-script e2e test only ever passed on
machines with a real key set — never verified in a clean environment
until this CI run (no secret configured, correctly).

Fixed by injecting an obviously-fake fixture key (TEST_ENV in
helpers.mjs, exported and reused by onboard.test.mjs) into every
subprocess these tests spawn, so behaviour no longer depends on the
ambient shell. Verified locally with \`env -u CONTEXT7_API_KEY\` to
reproduce the CI environment exactly: 58/58 pass either way now.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

tests/onboard.test.mjs

@@ -5,7 +5,7 @@ import { join, dirname } from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 
-import { tempRepo, cleanup } from './helpers.mjs';
+import { tempRepo, cleanup, TEST_ENV } from './helpers.mjs';
 
 after(cleanup);
 
@@ -18,6 +18,7 @@ function onboard(args) {
     const stdout = execFileSync(process.execPath, [ONBOARD, ...args], {
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'pipe'],
+      env: TEST_ENV,
     });
     return { code: 0, stdout, stderr: '' };
   } catch (e) {