Temp dir falls back when TMPDIR or /tmp is unusable (Termux); v0.6.1

os_temp_dir() used $TMPDIR or "/tmp" without checking either. On Termux
/tmp usually does not exist (or SELinux denies it) unless TMPDIR points at
$PREFIX/tmp, so plugin and MCP temp files failed and shell children that
need a temp file (heredocs) broke.

  * os_temp_dir() picks, once, the first of $TMPDIR, $PREFIX/tmp, /tmp,
    /var/tmp and ~/.cache/cst-agent/tmp where a file can really be
    created; if none works it keeps the old answer
  * os_temp_dir_export() at startup writes the choice back to TMPDIR, so
    shell children and the sandbox's writable temp dir agree
  * tests/test_tmpdir.c covers the fallbacks in fresh forks

include/os_compat.h

@@ -49,6 +49,9 @@ int os_mkdir(const char *path, int mode);
 int os_mkdir_p(const char *path, int mode);
 int os_config_dir(char *out, size_t out_sz);
 int os_temp_dir(char *out, size_t out_sz);
+/* Point TMPDIR at os_temp_dir() so child processes use the same writable
+ * directory. Call once at startup, before any threads. */
+void os_temp_dir_export(void);
 /* Create unique temp file; writes path into out; returns fd or -1. Caller closes. */
 int os_mkstemp(char *out, size_t out_sz, const char *prefix);