test: fix two Windows-environment-dependent failures (suite now fully green)

Both tests pre-dated this branch and failed only on Windows checkouts — the
product code was correct in both cases:

- audio-effects-executor 'preload exposes the trusted surface': asserted a
  byte-exact two-line bridge snippet with \n, which never matches a
  core.autocrlf (CRLF) working tree. Line endings are now normalized before
  the includes checks.

- config-paths 'SAFETY: ... ONLY in optInExtras': rebuilt the expected ML
  cache paths with host-native path.join, producing backslash paths that
  never equal the forward-slash simulated envs — failing the mlCaches
  equality and, worse, making the protected-root child checks vacuously
  pass on Windows (a silent coverage gap in the safety assertions). The
  test now uses the envs' resolved torchHome/hfHome fields, exactly what
  production returns, with '/' as the child separator.

npm test: 78/78 passing (1 quarantined storm gate, green under CHAIN_STORM=1).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/audio-effects-executor.test.js

@@ -376,8 +376,11 @@ test('audio-effects executor rejects coerced parameter indices', async () => {
 });
 
 test('preload exposes the trusted audio-effects executor surface', () => {
-    const preload = fs.readFileSync(path.join(ROOT, 'src', 'main', 'preload.ts'), 'utf8');
-    const bridge = fs.readFileSync(path.join(ROOT, 'src', 'main', 'audio-bridge.ts'), 'utf8');
+    // Normalize line endings: the multi-line snippet assertion below uses
+    // \n, but a Windows checkout with core.autocrlf reads these files as
+    // \r\n — the test must not depend on the developer's git config.
+    const preload = fs.readFileSync(path.join(ROOT, 'src', 'main', 'preload.ts'), 'utf8').replace(/\r\n/g, '\n');
+    const bridge = fs.readFileSync(path.join(ROOT, 'src', 'main', 'audio-bridge.ts'), 'utf8').replace(/\r\n/g, '\n');
 
     assert.equal(preload.includes('audioEffects: {'), true);
     for (const method of ['loadChainPlan', 'releaseRoute', 'inspectRoute', 'activateSegment', 'setStageBypass', 'setStageParameter', 'setRouteGain']) {

tests/config-paths.test.js

@@ -111,17 +111,23 @@ test('SAFETY: song library, installed plugins and ML caches are ONLY in optInExt
             ...cats.pluginStateAndPyDeps,
             ...cats.configDbsAndState,
         ];
-        // None of the safe categories may equal or be a child of the protected dirs.
+        // None of the safe categories may equal or be a child of the protected
+        // dirs. Use the env's RESOLVED fields (exactly what production
+        // returns) rather than rebuilding them with host-native path.join —
+        // on Windows that produced backslash paths that never matched the
+        // forward-slash simulated envs, failing the mlCaches equality AND
+        // silently vacuous-passing these child checks. The simulated env
+        // paths are forward-slash on every platform, so '/' is the separator.
         const protectedRoots = [
             env.dlcDir,
             env.pluginsDir,
-            path.join(env.cacheBase, 'torch'),
-            path.join(env.cacheBase, 'huggingface'),
+            env.torchHome,
+            env.hfHome,
         ];
         for (const root of protectedRoots) {
             assert.ok(!safe.includes(root), `${name}: ${root} leaked into a safe category`);
             assert.ok(
-                !safe.some((p) => p === root || p.startsWith(root + path.sep)),
+                !safe.some((p) => p === root || p.startsWith(root + '/')),
                 `${name}: a safe path lives under protected ${root}`,
             );
         }
@@ -130,7 +136,7 @@ test('SAFETY: song library, installed plugins and ML caches are ONLY in optInExt
         assert.deepEqual(cats.optInExtras.installedPlugins, [env.pluginsDir], `${name}: installedPlugins`);
         assert.deepEqual(
             cats.optInExtras.mlCaches,
-            [path.join(env.cacheBase, 'torch'), path.join(env.cacheBase, 'huggingface')],
+            [env.torchHome, env.hfHome],
             `${name}: mlCaches`,
         );
     }