fix(backend): make data root config authoritative

backend/test/list-models.test.ts

@@ -81,3 +81,29 @@ test("production model-list spawn preserves PATH and passes the portable data ro
     rmSync(path.dirname(script), { recursive: true, force: true });
   }
 });
+
+test("model-list spawn omits ambient THT_DATA_ROOT when config does not provide one", async () => {
+  const script = scriptWith([]);
+  const calls: any[][] = [];
+  const previousDataRoot = process.env.THT_DATA_ROOT;
+  const previousCredential = process.env.PI_PROVIDER_API_KEY;
+  process.env.THT_DATA_ROOT = "/ambient-must-not-leak";
+  process.env.PI_PROVIDER_API_KEY = "still-inherited";
+  try {
+    const lister = createPiModelLister(loadConfig({ PI_BIN: "/usr/local/bin/pi" }), {
+      spawnFn: (...args: any[]) => {
+        calls.push(args);
+        return spawn("node", [FAKE, script]) as any;
+      },
+    });
+    await lister();
+    expect(calls[0][2].env).not.toHaveProperty("THT_DATA_ROOT");
+    expect(calls[0][2].env.PI_PROVIDER_API_KEY).toBe("still-inherited");
+  } finally {
+    if (previousDataRoot === undefined) delete process.env.THT_DATA_ROOT;
+    else process.env.THT_DATA_ROOT = previousDataRoot;
+    if (previousCredential === undefined) delete process.env.PI_PROVIDER_API_KEY;
+    else process.env.PI_PROVIDER_API_KEY = previousCredential;
+    rmSync(path.dirname(script), { recursive: true, force: true });
+  }
+});