local-ci: concurrent legs share /tmp and can fail cli.test.ts artifact hygiene assertion

[ScriptedAlchemy]

Summary

packages/agent-bundle/tests/cli.test.ts includes a /tmp hygiene assertion: the suite snapshots agent-bundle-artifact-* directories under the shared system temp root and fails if new ones appear during the run. Under pnpm check:local-ci, four legs (verify on Node 22.19/24/26 plus the gates leg) run concurrently on one machine and share /tmp, so a sibling leg's legitimate artifact-inspection temp directory can appear inside another leg's scan window and fail the assertion.

This is cross-leg contamination inherent to the local-ci design, not a product defect. It produced a false-negative gate run while landing #86 (the failing step passed on re-run once the sibling leg's window no longer overlapped).

Evidence

• Observed on a check:local-ci run for refactor: simplify prebuilt-payload internals (post-#71 follow-up) #86: run 3 of 4 failed only on the cli.test.ts /tmp scan; the offending directory matched the artifact-inspection naming of a concurrent leg. Runs on the same commit with no overlap passed.
• The assertion is correct in isolation (single-leg hosted CI or a lone local run); only the four-leg concurrent topology breaks its assumption that the process owns the temp root.

Fix directions (either resolves it)

1. Give each local-ci leg its own TMPDIR (e.g. a per-leg directory under the run's scratch root) in scripts/local-ci.mjs, so every leg's temp traffic — and the test's scan — is naturally scoped. This also isolates any other shared-/tmp assumptions.
2. Scope the test: have cli.test.ts scan os.tmpdir() only for directories created by its own process tree (e.g. tag artifact temp dirs with the pid or a run token and filter on it), rather than asserting global /tmp emptiness.

Option 1 is the smaller, more general change and keeps the test's strictness; option 2 hardens the test even outside local-ci.

Acceptance

• Two concurrent check:local-ci legs each running the packed/CLI pools cannot fail each other's /tmp hygiene assertion.
• The assertion still catches a real leak (a directory created by the leg's own process tree and not cleaned up).