v1.27.1 — Security: privileged-command input is no longer staged in wo

Security: privileged-command input is no longer staged in world-writable /tmp. Same root cause as GHSA-mjmx-xpqq-p2h8 in a different set of sinks — a local hosting tenant could plant fixed, predictable filenames in /tmp and have a root cp follow a symlink (arbitrary root file read) or a root bash execute their script (arbitrary root code execution). All staging moves to /var/lib/inetpanel/staging, owner-only 0700, with unlink-then-O_EXCL writes. Upgrade recommended for any server with untrusted hosting accounts.