test: Add owned setup policy fixtures for CLI tests (#14456)
Expose a bounded, dev-dependency-only fixture seam for TURBO-6327
without adding production environment, root, or URL overrides.
```text
CLI tests
├── OwnedSetupFixture
│ └── Existing fail-closed official-source preflight
└── Literal-loopback transports
└── Proxies and certificate roots disabled
Production transports
└── Required OfficialSourcePolicy; official provenance unchanged
```
- Own ephemeral repository, home, system, and synthetic Node inputs.
- Reject traversal and symlink escapes outside the owned fixture.
- Add cross-crate consumers covering parser/root/executor behavior and
discovery drift.
- Preserve the current provisioning gate; native provisioning and
packaged-wrapper qualification remain separate work.
Refs TURBO-6327.
