ci: migrate mktemp -p test-scaffolding call sites to a portable form

[kyle-sexton]

This was generated by AI during work-loop execution.

Context

#1510 ("ci: enable staged shell-portability-lint classes") enables two of the three STAGED
shell-portability-lint classes (date -d, stat -c), fixing/annotating every corpus site each
touches. mktemp -p was deliberately left STAGED in that PR: unlike the other two classes, its
corpus (~24 files, ~56 call sites — scripts/shell-portability-tokens.txt's original "roughly 20
sites" estimate undercounted call sites vs. files) is all shared hook-test scaffolding across ~13
different plugins, none with a BSD-portable counterpart today (BSD mktemp has no -p). Migrating
it is a real, mechanical effort that touches every one of those plugins' release surface (a
plugin.json version bump + CHANGELOG entry per touched plugin under this repo's convention) — out
of scope for #1510's PR, which stays to check-shell-portability.sh/shell-portability-tokens.txt
plus the two dual-dialect script fixes.

Proposed work

• Migrate each mktemp -p "$DIR" prefix.XXXXXX site to the portable
  mktemp "$DIR/prefix.XXXXXX" form (works identically on GNU and BSD mktemp — the directory rides
  in the template instead of the -p flag).
• Migrate each mktemp -d -p "$DIR" prefix.XXXXXX site to mktemp -d "$DIR/prefix.XXXXXX".
• Migrate each bare mktemp -p "$DIR" (no explicit template) site to an explicit-template form,
  e.g. mktemp "$DIR/tmp.XXXXXXXXXX" — do not rely on TMPDIR-inheritance semantics, which differ
  between GNU and BSD mktemp when no template is given.
• Uncomment the mktemp -p token in scripts/shell-portability-tokens.txt's ACTIVE section once
  the corpus is clean, and update the STAGED section comment to drop the now-resolved entry.
• Run scripts/check-shell-portability.sh --all after uncommenting and confirm it is clean (or
  every remaining hit carries a reviewed portability-ok:).
• Bump plugin.json's version and add a CHANGELOG entry for every plugin whose test-scaffolding
  files are touched.

Acceptance criteria

• Every mktemp -p/mktemp -d -p call site in the corpus (enumerate fresh via
  grep -rn "mktemp[^\n]*-p" --include="*.sh" at execution time — the count above is a
  snapshot, not a fixed list) is migrated to a portable form, or carries a reviewed
  portability-ok: annotation with a stated reason.
• The mktemp -p token in scripts/shell-portability-tokens.txt is uncommented (moved to the
  ACTIVE section).
• scripts/check-shell-portability.sh --all exits 0 against the full repo.
• bash scripts/check-shell-portability.test.sh still passes (the staged-classes-inactive test
  at the bottom of that suite needs updating once all three classes are active).
• Every touched plugin's plugin.json version is bumped with a matching CHANGELOG entry.

References

• ci: enable staged shell-portability-lint classes (date -d, stat -c, mktemp -p) #1510 — enables the sibling date -d/stat -c classes; leaves mktemp -p staged for this item.
• ci: no gate covers shell portability — a GNU-only \b nearly shipped a fail-open security predicate #1491 — original shell-portability-lint gate.
• scripts/shell-portability-tokens.txt STAGED section — the mktemp -p entry this item resolves.

Metadata

Field	Value
Category	unspecified
Area	security
Ecosystem	unspecified

[kyle-sexton]

This was generated by AI during triage.

Duplicate of #1527. Read both bodies in full: they are byte-identical (same Context, Proposed
work, Acceptance criteria, References, Metadata), both filed during #1510's triage/implementation,
13 seconds apart — #1527 at 08:57:27Z, #1528 at 08:57:40Z. Closing the later-filed copy per duplicate
policy; #1527 carries the triage forward.