fix(ci): isolate audit and validation gate temp files

[shixi-li]

Summary

Make the shared audit and validation gate scripts safe to run concurrently from separate worktrees by isolating each invocation's temporary files.

Problem

Running scripts/ci-audit-gates.sh concurrently from two worktrees reproduced a race on the shared /tmp/root-audit.json and starter JSON files. One invocation failed while parsing a partially overwritten file:

SyntaxError: Unexpected end of JSON input

A serial rerun passed, which isolated the failure to the fixed cross-process temp paths rather than the audit content.

No matching open Issue or PR was found; this was discovered while dogfooding the repository's own gates.

Changes

• New pattern or starter

• Doc / example improvement

• Tool change (shared CI gate scripts)

• Story

• Create a unique mktemp directory per audit or validation invocation and remove it on exit.

• Keep all intermediate JSON and registry comparison files inside that directory.

• Preserve the audit workflow's PR-comment handoff through an explicit LOOP_AUDIT_OUTPUT_FILE path under ${{ runner.temp }}.

• Pass filenames and starter names to Node through environment variables instead of embedding them in JavaScript source.

Checklist (from CONTRIBUTING)

• Pattern sections reviewed (not applicable; no pattern content changed)
• Link/index requirements reviewed (not applicable; no documentation changed)
• No secrets, tokens, or internal company URLs
• STATE.md* convention reviewed (not applicable)
• Safety guidance reviewed (not applicable; behavior is unchanged)
• Ran the repository audit and validation gates

Testing / Dogfood

• Reproduced the baseline failure with two worktrees running bash scripts/ci-audit-gates.sh concurrently
• Ran two post-fix audit invocations concurrently; both passed and produced independently parseable JSON outputs
• Ran two post-fix bash scripts/ci-validate-gates.sh invocations concurrently; both completed successfully
• Ran bash scripts/ci-audit-gates.sh serially with LOOP_AUDIT_OUTPUT_FILE and parsed the exported JSON
• Ran bash scripts/ci-validate-gates.sh serially
• Ran bash -n scripts/ci-audit-gates.sh scripts/ci-validate-gates.sh
• Parsed .github/workflows/audit.yml with the repository's YAML dependency
• Ran git diff --check

The validation gate's mcp-server install still reports the repository's existing two moderate dependency advisories; this change adds no dependencies and both validation runs exit successfully.

Screenshots / Examples

Not applicable; this change has no UI.