fix(backend): make data root config authoritative

backend/test/pi-process-manager.test.ts

@@ -160,3 +160,23 @@ test("production spawn uses explicit Pi path and passes portable data root witho
     vi.unstubAllEnvs();
   }
 });
+
+test("session Pi spawn omits ambient THT_DATA_ROOT when config does not provide one", async () => {
+  vi.stubEnv("THT_DATA_ROOT", "/ambient-must-not-leak");
+  vi.stubEnv("PI_PROVIDER_API_KEY", "still-inherited");
+  const calls: any[][] = [];
+  const child = recordingChild();
+  child.stderr.resume = () => {};
+  const mgr = new PiProcessManager(loadConfig({ PI_BIN: "/usr/local/bin/pi" }), {
+    spawnFn: (...args: any[]) => { calls.push(args); return child as any; },
+  });
+
+  try {
+    await mgr.spawnFor("no-data-root", {});
+    expect(calls[0][2].env).not.toHaveProperty("THT_DATA_ROOT");
+    expect(calls[0][2].env.PI_PROVIDER_API_KEY).toBe("still-inherited");
+  } finally {
+    mgr.teardown("no-data-root");
+    vi.unstubAllEnvs();
+  }
+});