The template is the fix, not the directory

A bare mktemp ignores $TMPDIR on macOS. Setting TMPDIR therefore looks like a fix and changes nothing. Toggle both.

conditions TMPDIR points somewhere writable the call has an explicit template system temp dir denies the write

Why two earlier sweeps of this class both "succeeded"

sweep	scoped by	covered	real
#3550	directory (`.github/`)	part	bin/ too
this PR, 1st pass	regex dialect (`grep -E '\s'`)	30	76
this PR, shipped	whole tree, one dialect	76	76

ERE has no \s, so the scan matched nothing useful and reported a 76-file surface as 30 — including the very file being fixed. Both sweeps reported success. A gate that scans the whole tree in one dialect is the only thing that can claim coverage.

Measured, on the test that was failing

before	9 pass / 5 fail	6 denials
after	14 pass / 0 fail	0 denials

Six sightings in one day: count-hooks.sh, run-all-tests.sh, two tests/ci/ scripts written to catch this class, test-dead-generation-guard.sh, and pre-commit's hardcoded /tmp actionlint log.