ci: harden recall and secret guard checks

Author: lcalderon

.github/workflows/ci.yml

@@ -107,5 +107,8 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Install linux native bindings
+        run: npm install @rolldown/binding-linux-x64-gnu @tailwindcss/oxide-linux-x64-gnu @unrs/resolver-binding-linux-x64-gnu --no-save
+
       - name: Run recall canary gate
         run: npm run check:recall-canary

apps/memroos/src/lib/__tests__/db-ingest.test.ts

@@ -377,14 +377,14 @@ describe('db-ingest: direct provider file ingestion', () => {
       {
         type: 'user',
         timestamp: '2025-03-01T10:00:00Z',
-        cwd: '/home/user/project',
+        cwd: '/workspace/project',
         gitBranch: 'feature-x',
         message: { role: 'user', parts: [{ text: 'qwen hello' }] },
       },
       {
         type: 'assistant',
         timestamp: '2025-03-01T10:00:01Z',
-        cwd: '/home/user/project',
+        cwd: '/workspace/project',
         gitBranch: 'feature-x',
         message: { role: 'assistant', parts: [{ text: 'qwen reply' }] },
       },
@@ -400,7 +400,7 @@ describe('db-ingest: direct provider file ingestion', () => {
     expect(rows.length).toBe(2);
     expect(rows.every((row) => row.project === 'qwen:memroos')).toBe(true);
     expect(rows.every((row) => row.agent_id === 'memroos')).toBe(true);
-    expect(rows.every((row) => row.cwd === '/home/user/project')).toBe(true);
+    expect(rows.every((row) => row.cwd === '/workspace/project')).toBe(true);
     expect(rows.every((row) => row.git_branch === 'feature-x')).toBe(true);
     expect(rows[0].timestamp).toBe('2025-03-01T10:00:00Z');
   });

apps/memroos/src/lib/__tests__/env.test.ts

@@ -95,7 +95,7 @@ describe("loadMemroosEnv", () => {
   });
 
   it("validates startup configuration and returns root config status", () => {
-    const result = validateMemroosEnvAtStartup({ HOME: "/Users/USERNAME", MEM0_URL: "http://mem0.test" });
+    const result = validateMemroosEnvAtStartup({ HOME: "/tmp/memroos-home", MEM0_URL: "http://mem0.test" });
 
     expect(result.env.MEM0_URL).toBe("http://mem0.test");
     expect(result.rootConfigStatus.map((entry) => entry.file)).toEqual([