fix: isolate smoke test config home to stop cross-test interference [IDE-2108]

[basti-snyk]

Summary

• Fixes the flaky smoke test Test_SmokeScanPrecedence_OSSEnabled_CodeDisabled (Ubuntu CI), where the OSS scan never completed (28s timeout) with config-file errors from a parallel test in the logs.
• Root cause: the smoke-test setup helpers mutated the process-global xdg.ConfigHome (read by storage.NewStorageWithCallbacks via xdg.ConfigFile) and restored it in t.Cleanup. When two smoke tests ran concurrently, each writing its own t.TempDir() to that global, one test's storage/folder-config resolved into another test's directory — the folder config file was missing and the scan stalled.
• Fix: drop the xdg.ConfigHome mutation and instead set an explicit per-test SettingConfigFile on the engine configuration. folderconfig.ConfigFileFromConfig returns that explicit path before ever consulting the xdg global, so each test is fully isolated without touching shared process state. Applied at all four setup sites (precedence_smoke_test.go x3, ldx_sync_smoke_test.go).
• Adds isolation-invariant regression tests proving ConfigFileFromConfig returns the explicit path for the primary, legacy, and user-global keys and never falls back to xdg.ConfigHome.

Test plan

• go build ./..., go vet, golangci-lint ./internal/folderconfig/... clean (0 issues)
• go test ./internal/folderconfig/... -race race-clean over repeated runs; the kept isolation test proven RED if SettingConfigFile resolution regresses
• No xdg.ConfigHome assignment remains anywhere in the repo
• make test (full unit suite) green at this commit
• CI smoke shards (run on PR; live OSS scan needs network/token not available locally)

---

This fix was produced by an automated flake-fix loop.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Missing Directory Creation 🟡 [minor] The test setup now joins the temporary directory with a "snyk" subdirectory. While t.TempDir() creates the root temporary folder, it does not create the snyk child directory. If the downstream storage.NewStorageWithCallbacks or the config writer does not perform an os.MkdirAll, initialization will fail with a 'no such file or directory' error when trying to write ls-config.json. engine.GetConfiguration().Set(types.SettingConfigFile, filepath.Join(t.TempDir(), "snyk", "ls-config.json"))

📚 Repository Context Analyzed This review considered 6 relevant code sections from 6 files (average relevance: 1.00) docs/configuration.md (lines 576-713) infrastructure/code/fake_snyk_code_api_service.go (lines 1-122) application/di/test_init.go (lines 1-161) application/config/config.go (lines 1-196) docs/manual_testing_config_resolution.md (lines 1-138) benchmark/fixture.go (lines 1-193)