test: add spread+flag axios mock helper to stop CI mock pollution

Bare `mock.module('axios', () => ({ default: { stubs } }))` is
process-global last-write-wins and drops `axios.create`, `request`,
`isAxiosError`, etc. that real consumers need. In CI's alphabetical
file order, that produces dozens of polluted failures (AgentsPlatformView,
schedule API, memory-stores API, etc.) that don't reproduce on WSL2.

Introduce `tests/mocks/axios.ts` with `setupAxiosMock()` — `require('axios')`
inside the factory, spread real shape, route each verb through a per-suite
`useStubs` flag. beforeAll flips on, afterAll flips off; the spread
fall-through eliminates cross-file leakage.

Refactored 12 axios mockers in tests/, plus the bare `@anthropic/ink` mocks
in ultrareviewCommand and onboarding suites (same pollution pattern broke
AgentsPlatformView's Box/Text rendering).

Verified: 5339/5345 tests pass locally; remaining 6 failures are
pre-existing isolation issues unrelated to this change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/builtin-tools/src/tools/VaultHttpFetchTool/__tests__/VaultHttpFetchTool.test.ts

@@ -1,18 +1,27 @@
 import {
   afterAll,
   afterEach,
+  beforeAll,
   beforeEach,
   describe,
   expect,
   mock,
   test,
 } from 'bun:test'
+import { setupAxiosMock } from '../../../../../../tests/mocks/axios'
 
 // After this suite finishes, switch our getSecret override off so localVault's
-// own store.test.ts (running in the same process) sees the real impl.
+// own store.test.ts (running in the same process) sees the real impl. Also
+// flip the axios stub flag off so the spread mock falls through to real axios
+// for any test file that runs after this one.
 afterAll(() => {
   useMockForGetSecret = false
   getSecretShouldThrow = false
+  axiosHandle.useStubs = false
+})
+
+beforeAll(() => {
+  axiosHandle.useStubs = true
 })
 
 // We mock the LOWER layers (axios + localVault store + http util) rather
@@ -34,9 +43,8 @@ const mockAxiosRequest = mock(
   }),
 )
 
-mock.module('axios', () => ({
-  default: { request: mockAxiosRequest },
-}))
+const axiosHandle = setupAxiosMock()
+axiosHandle.stubs.request = mockAxiosRequest
 
 let mockedSecret: string | null = 'XSECRETXX'
 let getSecretShouldThrow = false