Add test safeguards to prevent production database pollution (bd-2c5a)

- Add failIfProductionDatabase() check in Go test helpers
- Add temp directory verification in RPC test setup
- Create conftest.py with pytest safety checks for Python tests
- Add BEADS_TEST_MODE env var to mark test execution
- Tests now fail fast if they detect production .beads/ usage

This prevents test issues from polluting the production database
like the incident on Nov 7, 2025 where 29+ test issues were created
in .beads/beads.db instead of isolated test databases.

Resolves: bd-2c5a
Amp-Thread-ID: https://ampcode.com/threads/T-635a8807-1120-4122-a0cb-4c21970362ce
Co-authored-by: Amp <amp@ampcode.com>

internal/rpc/rpc_test.go

@@ -19,6 +19,11 @@ func setupTestServer(t *testing.T) (*Server, *Client, func()) {
 		t.Fatalf("Failed to create temp dir: %v", err)
 	}
 
+	// CRITICAL (bd-2c5a): Verify we're using a temp directory to prevent production pollution
+	if !strings.Contains(tmpDir, os.TempDir()) {
+		t.Fatalf("PRODUCTION DATABASE POLLUTION RISK (bd-2c5a): tmpDir must be in system temp directory, got: %s", tmpDir)
+	}
+
 	// Create .beads subdirectory so findDatabaseForCwd finds THIS database, not project's
 	beadsDir := filepath.Join(tmpDir, ".beads")
 	if err := os.MkdirAll(beadsDir, 0750); err != nil {
@@ -132,6 +137,11 @@ func setupTestServerIsolated(t *testing.T) (tmpDir, beadsDir, dbPath, socketPath
 		t.Fatalf("Failed to create temp dir: %v", err)
 	}
 
+	// CRITICAL (bd-2c5a): Verify we're using a temp directory to prevent production pollution
+	if !strings.Contains(tmpDir, os.TempDir()) {
+		t.Fatalf("PRODUCTION DATABASE POLLUTION RISK (bd-2c5a): tmpDir must be in system temp directory, got: %s", tmpDir)
+	}
+
 	// Create .beads subdirectory so findDatabaseForCwd finds THIS database, not project's
 	beadsDir = filepath.Join(tmpDir, ".beads")
 	if err := os.MkdirAll(beadsDir, 0750); err != nil {