test(secrets-cli): CLI rig keeps the store outside the working directory (scadaproj#45)

The CLI host takes its working directory as the content root, and the rig put the store under it.
The old lexical store-path rule missed that on macOS only because the temp path is spelled
/var/... while the working directory reports /private/var/...; with Secrets-005's link resolution
the rule (correctly) refused it. The rig now runs from a sibling work/ directory.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

ZB.MOM.WW.Secrets/tests/ZB.MOM.WW.Secrets.Tests/Cli/SetCommandLineTests.cs

@@ -171,14 +171,20 @@ public sealed class SetCommandLineTests
         private readonly string _dir = Path.Combine(Path.GetTempPath(), $"zb-cli-{Guid.NewGuid():N}");
         private readonly string _key = Convert.ToBase64String(RandomNumberGenerator.GetBytes(32));
 
-        public CliRig() => Directory.CreateDirectory(_dir);
+        // The CLI's host takes its working directory as the content root, and the store must sit
+        // OUTSIDE the content root. The store used to live under the working directory; the old
+        // lexical path rule missed that on macOS only because the temp path is spelled /var/... while
+        // the working directory reports /private/var/... (Secrets-005 resolves the symlink).
+        private string WorkDir => Path.Combine(_dir, "work");
+
+        public CliRig() => Directory.CreateDirectory(Path.Combine(_dir, "work"));
 
         public async Task<CliResult> RunAsync(string[] args, string? stdin = null)
         {
             string dll = Path.Combine(AppContext.BaseDirectory, "ZB.MOM.WW.Secrets.Cli.dll");
             var psi = new ProcessStartInfo(Environment.GetEnvironmentVariable("DOTNET_HOST_PATH") ?? "dotnet")
             {
-                WorkingDirectory = _dir,
+                WorkingDirectory = WorkDir,
                 RedirectStandardInput = true,
                 RedirectStandardOutput = true,
                 RedirectStandardError = true,