Inject an Env seam into home directory resolution

[leynos]

Context

home_from_env in src/stdlib/path/path_utils.rs:155-170 reads up to five environment variables ambiently, across two #[cfg] branches:

#[cfg(windows)]
fn home_from_env() -> Option<String> {
    env::var("HOME")
        .or_else(|_| env::var("USERPROFILE"))
        .ok()
        .or_else(|| match (env::var("HOMEDRIVE").ok(), env::var("HOMEPATH").ok()) {
            (Some(drive), Some(path)) if !path.is_empty() => Some(format!("{drive}{path}")),
            _ => env::var("HOMESHARE").ok(),
        })
}

This is the worst offender in the codebase for ambient environment access: a five-variable precedence ladder with an empty-string edge case, none of which can be exercised without mutating the real environment. The Windows branch is additionally unreachable from the CI host. Under the AGENTS.md testing mandate it currently has no legitimate test route at all.

Required work

• Take an injected environment reader (a closure Fn(&str) -> Option<String>) in home_from_env and its callers, supplying the process-backed reader at the stdlib::path boundary.
• Make the #[cfg(windows)] ladder testable independently of the host by extracting the precedence logic into a cfg-free helper that takes the injected environment, leaving only the platform selection behind #[cfg].
• Add rstest cases covering: HOME set; HOME unset with USERPROFILE set; the HOMEDRIVE/HOMEPATH pair; the empty-HOMEPATH edge case falling through to HOMESHARE; and nothing set.

Acceptance criteria

• No env::var call remains in src/stdlib/path/path_utils.rs.
• The Windows precedence ladder is covered by tests that run on a Unix CI host.
• make check-fmt, make lint, and make test pass.

---

Amended 2026-08-05: the injection requirement originally named mockable::Env/mockable::DefaultEnv. The repository's established seam for this boundary is a closure reader (as in stdlib::path, output_mode, output_prefs, and theme), and adding a trait-object dependency for one call site is disproportionate; the requirement now states the closure seam that PR #499 implements. The substance — no ambient env::var in path_utils.rs, both ladders testable from a Unix host — is unchanged.

[coderabbitai]

🔗 Related PRs

leynos/vk#163 - Add regression tests for coderabbit comment spacing [closed]
#497 - Stop the mock environment mutating the real process environment (#490) [open]
#498 - Give the workspace fallback switch an injectable env seam (#487) [open]
#501 - Give the manifest env() helper an injectable env seam (#484) [open]
#502 - Make the locale test stub strict about unexpected variable reads (#489) [open]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[leynos]

Tracked under #496.

[leynos]

Acceptance criterion corrected

The issue stated:

• No env::var call remains in src/stdlib/path/path_utils.rs.

That was too literal, and PR #499 does not meet it as written. Moving env::var up to the stdlib::path boundary would relocate the composition root, not remove it — something must read the process, and threading a closure onward means expanduser takes a reader, then its callers do, then the Jinja filter registration does, to move one call site.

Revised criterion: the ladders take an injected lookup and are fully covered without process mutation; home_from_env remains the single composition root and is annotated as such once #505 lands, so an unannotated env::var elsewhere in the module fails make lint.

Delivered against that: both ladders are injected, sixteen cases cover them including the Windows branch from a Unix host, and a genuine HOMEDRIVE bug surfaced and was fixed as a result.