Use writable /tmp TMPDIR for tests on both CI runners

[TeoSlayer]

Problem

The Test (pkg + cmd + internal, -short) step fails on the hosted runners with many:

t.TempDir(): mkdir /Users/runner/work/_temp/...: permission denied   # macOS
t.TempDir(): mkdir /home/runner/work/_temp/...: permission denied     # ubuntu

t.TempDir() resolves its parent via os.TempDir() -> $TMPDIR. The hosted runners hand out a $RUNNER_TEMP (/Users/runner/work/_temp, /home/runner/work/_temp) whose ACLs reject sub-directory creation, so every t.TempDir() call fails. #312 redirected macOS to a fresh /tmp dir but left ubuntu pointed at the broken $RUNNER_TEMP — and the same runner regression has now started hitting ubuntu too (see recent main + PR runs).

Fix

Point $TMPDIR at a freshly-created, world-writable dir under /tmp (writable by the test process on both Linux and macOS) for the test run: block, with a $RUNNER_TEMP fallback if /tmp is ever unavailable. The export lives in the same run: block as go test, and no job/step-level env: TMPDIR: exists in this workflow, so nothing overrides it.

• Applies to both matrix legs (the failure is no longer macOS-only).
• No tests skipped or deleted; only the temp root moves.

🤖 Generated with Claude Code

[TeoSlayer]

Note: the TMPDIR fix is verified working — CI logs now print using TMPDIR=/tmp/gotmp... and all t.TempDir(): permission denied failures are gone on both runners. One macOS run flaked on TestNagleFlushSubMSSWithUnackedRetxStopAborts (a pre-existing t.Parallel() 20ms-sleep timing test in pkg/daemon, unrelated to TMPDIR — passes 5/5 locally and on rerun). Not introduced by this change.