fix: 修复 CI 中 10 个测试的 Bun mock.module 跨文件污染

- thinking.test.ts: 补 envUtils.js 防御性 mock，提供 isEnvDefinedFalsy
  和 isEnvTruthy 正确实现，覆盖 6 个其他测试文件不完整 mock 导致的污染
- launchLocalVault.test.ts: 补 keychain.js 防御性 mock，强制抛
  KeychainUnavailableError 使 store 走文件回退路径，覆盖 store.test.ts
  和 keychain.test.ts 的 mock 残留

Co-Authored-By: glm-5-turbo <zai-org@claude-code-best.win>

src/commands/local-vault/__tests__/launchLocalVault.test.ts

@@ -7,9 +7,30 @@ import { logMock } from '../../../../tests/mocks/log.js'
 mock.module('src/utils/log.ts', logMock)
 mock.module('bun:bundle', () => ({ feature: () => false }))
 
-// No keychain mock here — the real store falls back to encrypted file when
-// @napi-rs/keyring is not installed (which it is not in this environment).
-// This exercises the full file-fallback path without cross-test module pollution.
+// Re-register ../keychain.js to override pollution from store.test.ts (which
+// mocks keychain as always-throwing) and keychain.test.ts (which mocks it with
+// an in-memory MockEntry). Force KeychainUnavailableError so the store always
+// uses the encrypted-file fallback path.
+class KeychainUnavailableError extends Error {
+  override name = 'KeychainUnavailableError'
+}
+
+const keychainUnavailable = async (): Promise<never> => {
+  throw new KeychainUnavailableError('test: keychain mocked as unavailable')
+}
+
+mock.module('../../../services/localVault/keychain.js', () => ({
+  KeychainUnavailableError,
+  tryKeychain: {
+    set: keychainUnavailable,
+    get: keychainUnavailable,
+    delete: keychainUnavailable,
+    list: keychainUnavailable,
+    _addToIndex: keychainUnavailable,
+    _removeFromIndex: keychainUnavailable,
+  },
+  _resetKeychainModuleCache: () => {},
+}))
 
 let callLocalVault: typeof import('../launchLocalVault.js').callLocalVault