fix(test): onboard-session lock tests share tmpDir causing order dependence

[ericksoa]

Bug

In src/lib/onboard-session.test.ts, all lock tests share a single tmpDir. releaseOnboardLock() can leave malformed lock files behind, and the beforeEach hook only clears the module cache and session file — not the lock artifacts. This makes lock tests order-dependent.

Fix

Recreate tmpDir in beforeEach (or fs.rmSync + fs.mkdirSync) so each test starts clean.

Found by

CodeRabbit review on #1272. Pre-existing from original JS.