test(cli): the spec script's package export gives the audit override; macOS tests keep short paths

GitHub's check on 62d42b94: the spec script now runs `books.audit`
(P8), so the package gate is live when the script exports and the
run is behind the head; four tests failed on `audit_required`. The
script gives `without_audit_reason`, as a human would.

The portable macOS job, with the server's log in hand: "the books'
private folder's path is too long for its sockets". A Unix socket path
holds 104 bytes; the runner's temp folder plus a test home plus
`Library/Application Support/wanderbooks/run/` is longer. The job sets
TMPDIR=/tmp, so every test home is short there.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

.github/workflows/portable.yml

@@ -35,6 +35,12 @@ jobs:
       CARGO_INCREMENTAL: "0"
       CARGO_PROFILE_DEV_DEBUG: line-tables-only
       CARGO_PROFILE_TEST_DEBUG: line-tables-only
+      # macOS: a Unix socket path holds 104 bytes, and the runner's default
+      # temp folder (/var/folders/...) plus a test home plus
+      # `Library/Application Support/wanderbooks/run/` is longer than that;
+      # the server then refuses the root ("too long for its sockets"). The
+      # tests' temp homes go under /tmp there. Windows ignores TMPDIR.
+      TMPDIR: /tmp
     steps:
       - uses: actions/checkout@v4
       - name: Rust (the version mise.toml pins)

crates/ledger-cli/tests/spec_mcp.rs

@@ -1302,15 +1302,20 @@ fn happy_path(name: &str) -> Mcp {
         "books.export",
         json!({"format": "iif", "report": "general_journal", "as_of": "2026-12-31"}),
     );
+    // The script ran an audit above, so the package's gate (P8) is live
+    // and the run no longer stands at the head: the owner's override, as
+    // a human would give it.
     m.ok(
         "books.export_cpa_package",
         json!({"as_of": "2026-12-31", "include_receipts": false, "include_tins": false,
-                "allow_open_drafts": {"reason": "the test books keep drafts open"}}),
+                "allow_open_drafts": {"reason": "the test books keep drafts open"},
+                "without_audit_reason": "the script's audit is behind the head; the test exports anyway"}),
     );
     m.ok(
         "books.export_cpa_package",
         json!({"as_of": "2026-12-31", "include_receipts": false,
-                "allow_open_drafts": {"reason": "the test books keep drafts open"}}),
+                "allow_open_drafts": {"reason": "the test books keep drafts open"},
+                "without_audit_reason": "the script's audit is behind the head; the test exports anyway"}),
     );
 
     // The access log, the backups' status, and a backup now (none is set