Serialize testing.invoke cwd handling and document its process-global contract

[codeforester]

Problem

The testing.invoke(cwd=...) implementation temporarily calls os.chdir() so relative file I/O in the invoked command sees the fixture directory. That mutation is process-global, so concurrent threaded invocations can race and observe one another's working directory. The README still describes the old non-mutating behavior.

Scope

• Serialize invoke(cwd=...) calls while the process-global cwd is changed.
• Preserve restoration of the caller's cwd on success and failure.
• Add regression coverage for the serialized cwd contract.
• Update the Testing documentation to state the process-global mutation and thread-safety limitation accurately.

Acceptance criteria

• Two concurrent helper calls cannot overlap their temporary process cwd changes.
• The original cwd is restored after each call.
• Documentation no longer claims that invoke(cwd=...) avoids process-global cwd mutation.