fix(backend): make data root config authoritative

backend/test/tht-runner.test.ts

@@ -24,6 +24,54 @@ test("sessionNew parses id from JSON", async () => {
   expect(await r.sessionNew({ question: "q" })).toEqual({ id: "2026-06-27-100000-x" });
 });
 
+test("run passes configured THT_DATA_ROOT and preserves the remaining environment", async () => {
+  const previousDataRoot = process.env.THT_DATA_ROOT;
+  const previousCa = process.env.NODE_EXTRA_CA_CERTS;
+  process.env.THT_DATA_ROOT = "/ambient";
+  process.env.NODE_EXTRA_CA_CERTS = "/certs/company-ca.pem";
+  try {
+    (spawn as any).mockClear();
+    const r = new ThtRunner({
+      thtBin: "/opt/venv/bin/tht",
+      harnessDir: "/app/harness",
+      configPath: "config/tht.yaml",
+      dataRoot: "/configured",
+    });
+    await r.run(["session", "list", "--json"]);
+    const [bin, , options] = (spawn as any).mock.calls[0];
+    expect(bin).toBe("/opt/venv/bin/tht");
+    expect(options.env).toMatchObject({
+      THT_DATA_ROOT: "/configured",
+      NODE_EXTRA_CA_CERTS: "/certs/company-ca.pem",
+    });
+  } finally {
+    if (previousDataRoot === undefined) delete process.env.THT_DATA_ROOT;
+    else process.env.THT_DATA_ROOT = previousDataRoot;
+    if (previousCa === undefined) delete process.env.NODE_EXTRA_CA_CERTS;
+    else process.env.NODE_EXTRA_CA_CERTS = previousCa;
+  }
+});
+
+test("run omits ambient THT_DATA_ROOT when config does not provide one", async () => {
+  const previousDataRoot = process.env.THT_DATA_ROOT;
+  const previousCredential = process.env.PI_PROVIDER_API_KEY;
+  process.env.THT_DATA_ROOT = "/ambient-must-not-leak";
+  process.env.PI_PROVIDER_API_KEY = "still-inherited";
+  try {
+    (spawn as any).mockClear();
+    const r = new ThtRunner({ thtBin: "tht", harnessDir: "/h", configPath: "config/tht.yaml" });
+    await r.run(["session", "list", "--json"]);
+    const options = (spawn as any).mock.calls[0][2];
+    expect(options.env).not.toHaveProperty("THT_DATA_ROOT");
+    expect(options.env.PI_PROVIDER_API_KEY).toBe("still-inherited");
+  } finally {
+    if (previousDataRoot === undefined) delete process.env.THT_DATA_ROOT;
+    else process.env.THT_DATA_ROOT = previousDataRoot;
+    if (previousCredential === undefined) delete process.env.PI_PROVIDER_API_KEY;
+    else process.env.PI_PROVIDER_API_KEY = previousCredential;
+  }
+});
+
 test("run with exit != 0 propagates error with stderr", async () => {
   const r = new ThtRunner({ thtBin: "tht", harnessDir: "/h", configPath: "config/tht.yaml" });
   r.run = async () => ({ code: 1, stdout: "", stderr: "ERRORE: boom" });