test: characterize survivors before C5-C9 refactor (desloppify C4)

Adds 6 characterization test files pinning runtime behavior for modules
slated for C5 decomposition and C7-C9 splits. All 67 tests pass; coverage
targets the pure-function contracts that the upcoming moves must preserve.

Files:
- tests/unit/commands/files-handler.test.ts (10 tests)
  Covers capFileAccountMap FIFO eviction at FILE_ACCOUNT_MAP_MAX_SIZE=1000,
  resolveTargetAccount unknown-id rejection, and the 5-action dispatcher
  (list/upload/get/delete/download) with account pinning side effects.
- tests/unit/fingerprint/merge.test.ts (8 tests)
  Pins resolveRequestProfile: blank/trimmed/unknown version fallback,
  verified-over-candidate precedence, critical-field blocking, and
  normalizeMergeConfig defaults.
- tests/unit/cli/status-api.test.ts (8 tests)
  Locks oauth status endpoint URLs, buildOAuthStatusHeaders shape, and
  extractErrorMessage fallbacks (nested error.message, HTTP status,
  non-JSON body, fetch throw).
- tests/unit/session-scope.test.ts (17 tests)
  Exercises every path of extractOpenCodeSessionKey's 7-path precedence
  plus createSessionScopeTracker stable signature assignment.
- tests/unit/env.test.ts (12 tests)
  Covers isTruthyEnv, isFalsyEnv, and parseAnthropicCustomHeaders across
  whitespace, case, duplicates, and malformed lines.
- tests/unit/config-shape.test.ts (2 tests)
  Asserts DEFAULT_CONFIG matches the documented nested shape (all 11
  subtrees including cc_credential_reuse) and nested-clone independence.

Resolves desloppify cluster characterization-tests-on-survivors (6/6 members,
4/4 steps). Gate for C5 root-package-decomposition, C7 account-manager-load-
split, C8 monolith-splits, and C9 repair-twin-api-dedup.