fix(entrypoint): make the per-run work dir honour TMPDIR on every host

[luisleo526]

Fix a macOS-only host-run test failure: the entrypoint's private work dir did not honour TMPDIR.

Why

Hosted macOS CI on the engine fails one case of row 14 (tests/test_compile_inventory_pipeline.py::test_selected_precompiled_cpp_is_frozen_once_and_every_consumer_uses_the_copy, :771) — the test asserts the private snapshot the compiler is given lives under the TMPDIR it passed in.

docker/entrypoint.sh:99 was WORK="$(mktemp -d)". macOS /usr/bin/mktemp ignores $TMPDIR for the no-template form and uses the Darwin per-user temporary directory; GNU coreutils mktemp honours $TMPDIR. So GEN="${WORK}/strategy.cpp" landed under TMPDIR on Linux only, and the assertion held on Linux and failed on macOS. The test's expectation is the correct one; the entrypoint was portable by accident.

The change

One line:

-WORK="$(mktemp -d)"
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/pf-work.XXXXXXXXXX")"

An explicit template makes both implementations create the directory the caller asked for. The comment above it and the trap 'rm -rf "$WORK"' EXIT cleanup are unchanged; GEN and SO are still children of WORK.

On Linux the work directory stays in /tmp (TMPDIR is unset inside the container) and only its name pattern changes; nothing reads that path (it is passed to the compiler and to run_json.py and removed on exit by the same trap).

Evidence

• The PR's hosted CI is extra evidence: macOS Debug and Release must show row 14 Passed, 52/52, and the Linux jobs unchanged.
• The merge gate is pineforge/verify, run through lab remote on this head; docker/entrypoint.sh is in the release-harness class, so pineforge/parity goes --via diff with no sweep.

Notes / not proved

• The macOS behaviour of mktemp above was observed for the no-template form; the template form was not executed on macOS in this work — the fix relies on the documented template behaviour of both implementations.
• No test was run on a Mac for this change; the proof is the hosted CI run.
• Follow-up (owned by the release, not this PR): the hub carries the engine's entrypoint.sh byte for byte (blob 294cc0d3 in both today), so the hub must be synced to the new file for the 1.5.0-final cut or the smoke kit's harness-equality rule refuses.

🤖 Generated with Claude Code