The third way is correct. Exactly why is covered in wonderful detail in The Elements of Statistical Learning, see the section "The Wrong and Right Way to Do Cross-validation", and also in the final chapter of Learning From Data, in the stock market example.
Essentially, procedures 1 and 2 leak information about either the response, or from the future, from your hold out data set into the training, or evaluation, of your model. This can cause considerable optimism bias in your model evaluation.
The idea in model validation is to mimic the situation you would be in when your model is making production decisions, when you do not have access to the true response. The consequence is that you cannot use the response in the test set for anything except comparing to your predicted values.
Another way to approach it is to imagine that you only have access to one data point from your hold out at a time (a common situation for production models). Anything you cannot do under this assumption you should hold in great suspicion. Clearly, one thing you cannot do is aggregate over all new data-points past and future to normalize your production stream of data - so doing the same for model validation is invalid.
You don't have to worry about the mean of your test set being non-zero, that's a better situation to be in than biasing your hold out performance estimates. Though, of course, if the test is truly drawn from the same underlying distribution as your train (an essential assumption in statistical learning), said mean should come out as approximately zero.
R? See this question: stackoverflow.com/questions/49260862/… $\endgroup$