fix(testing): make the no-sdk-mocks guard path-separator agnostic

`relative()` returns host-specific separators, so on Windows the offender
check produced `packages\testing\…` and matched none of the forward-slash
ALLOWLIST keys. Every allowlisted spec would have been reported as an
offender and the guard would have failed for the wrong reason.

That direction is the safe one — a false failure, not a false pass — but a
guard that cries wolf is a guard someone disables, and this one is now the
only thing preventing SDK mocks from returning.

Normalizes to POSIX form before the allowlist lookup. The offender list is
reported in the same form, so its output stays copy-pasteable into the
allowlist on any platform.

The sibling stale-entry check needed no change: it feeds allowlist keys
through `join()`, which normalizes forward slashes on Windows already.

Verified the guard still fails on a planted `vi.mock("@temporalio/workflow")`
and names the file in POSIX form.

Reported by Copilot on #359.

Author: btravers

packages/testing/src/no-sdk-mocks.spec.ts

@@ -1,11 +1,25 @@
 import { readFile, readdir } from "node:fs/promises";
-import { join, relative } from "node:path";
+import { join, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { describe, expect, it } from "vitest";
 
 const WORKSPACE_ROOT = fileURLToPath(new URL("../../../", import.meta.url));
 
+/**
+ * Workspace-relative path in POSIX form, whatever the host separator is.
+ *
+ * `relative()` yields `packages\testing\…` on Windows, which matches none of
+ * the forward-slash {@link ALLOWLIST} keys — every allowlisted spec would be
+ * reported as an offender and the guard would fail for the wrong reason. A
+ * guard that cries wolf is a guard someone disables, so normalize before the
+ * lookup. The offender list is reported in the same form, so its output is
+ * copy-pasteable into the allowlist on any platform.
+ */
+function workspaceRelative(absolutePath: string): string {
+  return relative(WORKSPACE_ROOT, absolutePath).split(sep).join("/");
+}
+
 /**
  * Spec files permitted to mock the Temporal SDK. Every entry needs a reason
  * naming why the behavior is unreachable on a real time-skipping server.
@@ -70,7 +84,7 @@ describe("no SDK mocks outside the allowlist", () => {
     const offenders: string[] = [];
 
     for (const file of files) {
-      const rel = relative(WORKSPACE_ROOT, file);
+      const rel = workspaceRelative(file);
       const source = await readFile(file, "utf8");
       if (SDK_MOCK.test(source) && !(rel in ALLOWLIST)) {
         offenders.push(rel);