isOnMountPoint NUL-path test depends on cwd: fails whenever the checkout is on a mount #2604

Problem

isOnMountPoint > is false when the path itself can't be resolved (clients/web/src/test/integration/auth/node/secret-store-selection.test.ts:247) fails whenever the tests run from a directory on a mount: a Docker sandbox, a dev container, or a CI runner with a mounted checkout. In #2568's fan-out it failed in all seven worktrees, and the failure was written off as environmental each time.

The test's premise is false. It calls isOnMountPoint("bad\0path") with the comment "A NUL byte makes path.resolve throw." It does not:

$ node -e 'console.log(JSON.stringify(require("path").resolve("bad\0path")))'
"/Users/.../bad\u0000path"
$ node -e 'console.log(require("fs").existsSync("bad\0path"))'
false

So nearestExisting() (core/auth/node/secret-store-selection.ts:197) never reaches the error path. It walks up to the nearest ancestor that exists, which is the current working directory, and isOnMountPoint then answers for that directory. Where cwd sits under a mount (here /Users/cliffhall/Projects/mcp-inspector-v2 is a virtiofs mount in /proc/self/mountinfo), it returns true. The catch the test says it covers never runs. The test passes in CI only because CI's cwd happens not to be mounted.

Two defects

1. Source: isOnMountPoint's docs promise that a path it cannot resolve answers false, the conservative fallback. A NUL-bearing path is not unresolvable to it. It is silently replaced by an ancestor and judged by that ancestor, so a malformed configured path can read as "durable" because of where the process happens to be running.
2. Test: the result depends on the environment, and the error branch is never exercised.

Expected

• isOnMountPoint rejects a path containing \0 up front with return false, so the documented contract holds no matter where it runs.
• The test passes no matter where it runs, whether or not cwd is a mount. If the catch branch needs coverage, force it directly, for example by stubbing fs.existsSync to throw, as the neighbouring loadWithMounts suite already stubs fs for its mountinfo cases. Correct the comment.
• The test is confirmed passing from a mounted checkout, not just from an unmounted one.