tests: move the test-only constructors into export_test.go (closes #111)

state.NewForTest, state.NewForTestWithDataDir and watcher.NewForTest
were in ordinary source files, so they were built into the binary.
NewForTestWithDataDir and watcher.NewForTest now live in their
package's export_test.go. Tests in other packages cannot see those
files, so the watcher and middleware tests build their State with
state.New and a temporary data directory; the watcher tests no longer
try to save to /state.json. state.NewForTest, whose State saved to /,
is deleted: the state tests that used it pass t.TempDir() to
NewForTestWithDataDir, and the test of the helper itself is gone.

Model: opus-5-5

TODO.md

@@ -19,8 +19,8 @@ Rationale, Design, TODO, License, Author) if any are still missing.
 
 # Completed Steps
 
-- 2026-10-01: `internal/state` and `internal/watcher` no longer export test-only
+- 2026-10-01: the test-only constructors moved to `export_test.go`, out of the
-  constructors: two moved to `export_test.go`, one is deleted (closes #111).
+  binary; no test builds a `State` that saves to `/` any more (closes #111).
 - 2026-09-29: the live-DNS test package is renamed `internal/livednstest` and
   added to the `test-support` `deny` list in `.golangci.yml`, so `make lint`
   fails when program code imports it (closes #164).