Temp dir falls back when TMPDIR or /tmp is unusable (Termux); v0.6.1

os_temp_dir() used $TMPDIR or "/tmp" without checking either. On Termux
/tmp usually does not exist (or SELinux denies it) unless TMPDIR points at
$PREFIX/tmp, so plugin and MCP temp files failed and shell children that
need a temp file (heredocs) broke.

  * os_temp_dir() picks, once, the first of $TMPDIR, $PREFIX/tmp, /tmp,
    /var/tmp and ~/.cache/cst-agent/tmp where a file can really be
    created; if none works it keeps the old answer
  * os_temp_dir_export() at startup writes the choice back to TMPDIR, so
    shell children and the sandbox's writable temp dir agree
  * tests/test_tmpdir.c covers the fallbacks in fresh forks

CMakeLists.txt

@@ -256,7 +256,7 @@ foreach(t test_llm_body test_sse_decode test_apply_patch test_session_roundtrip
           test_undo test_config test_models test_sandbox
           test_keymap test_shell_compact test_skills
           test_plugins test_mcp test_subagent test_lowil
-          test_win_utf8 test_os_dir)
+          test_win_utf8 test_os_dir test_tmpdir)
   add_executable(${t} tests/${t}.c ${CST_CORE_SOURCES})
   target_include_directories(${t} PRIVATE include "${CJSON_DIR}")
   target_compile_definitions(${t} PRIVATE _GNU_SOURCE)