Skills host-root tests are polluted by the runner user environment

Three skills extension tests fail on a checkout located beneath a user home that contains .agents content:

• ext::skills::host_service_tests::snapshot_for_config_merges_extension_host_and_legacy_plugin_roots
• ext::skills::host_service_tests::snapshot_for_config_preserves_host_precedence_for_symlinked_plugin_root
• ext::skills::host_roots_tests::repo_ancestry_without_project_marker_does_not_walk_parents

The failures include skills from the runner user's global ~/.agents/skills and discover the workspace parent .agents root, changing the expected isolated fixture result. Reproduction on the current upstream main is possible with:

cargo nextest run -p codex-skills-extension -E "test(snapshot_for_config_merges_extension_host_and_legacy_plugin_roots)"
cargo nextest run -p codex-skills-extension -E "test(snapshot_for_config_preserves_host_precedence_for_symlinked_plugin_root)"
cargo nextest run -p codex-skills-extension -E "test(repo_ancestry_without_project_marker_does_not_walk_parents)"

Please make these tests hermetic by isolating or overriding global and parent skill discovery, then remove the temporary test quarantines.

Start in the codex-skills-extension tests named in the issue and run the three provided cargo nextest commands on upstream main. Trace how global and parent skill discovery enters these fixtures, then isolate or override it so the expected results are stable and remove the temporary test quarantines.