launch-attestation-real-nono test fixture overlaps nono's default macOS grants (fails 3/4 on macOS) #650

packages/cli/test/launch-attestation-real-nono.test.ts fails 3 of 4 cases on macOS (nono 0.74.0). It places its fixture HOME under /var/tmp. On macOS, nono's default policy grants read on /private/var (group system_read_macos), which overlaps nono's own state root under that HOME, so nono refuses to start the sandbox. CI runs this file only in the Linux attested Docker lane, where /var/tmp is not granted, so the failure has been invisible.

#648 fixed the same class in sandboxed-launch-516.test.ts with realNonoHomeBase() in test/helpers/launcher-grants.ts: it asks real nono which candidate base its policy and the launcher's grants leave ungranted, and throws, naming each refusal, when none fits.

Acceptance: this file uses the same chooser and passes on macOS with real nono and in the attested lane.