v0.3.5

What's changed

• fix(serve): switch serve.mjs temp dir to mkdtempSync + pointer file, resolving CodeQL alert #18 (js/insecure-temporary-file, CWE-377/378). The app's random temp dir path is persisted in scripts/install-test/.serve-dir (outside tmpdir) so --reuse continues to work across restarts. This change is in dev tooling only — the published package is unchanged.

Note: The dependency audit CI check fails on this repo due to a pre-existing transitive esbuild < 0.28.1 vulnerability via @payloadcms/db-sqlite → drizzle-kit → @esbuild-kit/core-utils. This is upstream of Payload and not introduced by this release.