fix(ci): close the RUN_TESTS_STRICT leak at its source, not at each caller

7607522 fixed the symptom in the wrong place. It made `test-run-tests.sh`'s
`run_fake()` spawn fixtures via `env -u RUN_TESTS_STRICT`, which stops that one
suite inheriting strictness — and leaves every future suite to defend itself the
same way. The variable's only job is done the moment `run-tests.sh` latches it
into the `STRICT` shell local, so it is unset there now and the leak is gone for
every child. The `env -u` stays as this suite's own defence in depth rather than
as the fix.

Two corrections to that commit's account of the bug, both overstated and both
cheap to have checked:

- The blast radius was two assertions, cases 10c and 10g, not six. Nothing else
  in the repo reads `RUN_TESTS_STRICT`.
- The pre-push gate was never red. It invokes `bash tests/run-tests.sh --strict`,
  and the flag sets a shell local that is never exported, so the flag spelling
  never leaked at all. Only the env-var spelling did.

That asymmetry between the two documented spellings is the real finding, and
nothing asserted against it. Case 10b compared the parent's verdict, which is the
half that already matched; the halves that differed were the environments the two
spellings handed every dispatched suite. New case 10i asks a child directly —
`${VAR+set}`, so an exported empty value still counts as a leak — and asserts the
two observations equal each other rather than a hardcoded expectation, so they
cannot drift apart in a direction the case did not anticipate.

tests/run-tests.sh

@@ -36,6 +36,22 @@ STRICT=false
 if [[ "${RUN_TESTS_STRICT:-}" == "1" ]]; then
   STRICT=true
 fi
+# Latched, then REMOVED from the environment. The value has done its only job by
+# this line -- it is now held in the STRICT shell local -- and leaving it exported
+# makes strictness leak down the whole process tree: every test-*.sh dispatched
+# through batch_run below inherits it, and any of them that itself invokes
+# run-tests.sh (tests/test-run-tests.sh drives a copy of this script over fixture
+# trees) silently turns a deliberately non-strict fixture strict.
+#
+# That is not symmetric with `--strict`, which never leaked: the flag only ever
+# sets the shell local above, so `bash tests/run-tests.sh --strict` (the spelling
+# the run-tests pre-push hook uses) always gave children a clean environment. Only
+# the env-var spelling leaked, and it broke exactly two assertions in
+# tests/test-run-tests.sh -- its cases 10c and 10g. Unsetting here makes the two
+# documented invocations equivalent in what a CHILD sees, not just in the parent's
+# verdict, so no future suite has to defend itself the way test-run-tests.sh's
+# run_fake() does with `env -u`.
+unset RUN_TESTS_STRICT
 # A loop rather than the `[[ "${1:-}" == --bats-only ]]` test this used to be, so
 # the two flags compose and an unknown flag is rejected instead of ignored. A
 # silently-ignored `--strict` is the one typo that would turn the gate back off.