fix(scripts): use mktemp for state.json writes, not a fixed /tmp path

Ten state-mutating sites across seven scripts wrote through a predictable,
world-writable temp path (`/tmp/state.json`, `/tmp/system-state.json`)
before the atomic `sudo mv`. Because the `>` redirect runs as the invoking
user (sudo doesn't cover redirects), the shared fixed path is a symlink/
TOCTOU target and collides if two of these run concurrently. Switch each
to a per-invocation `mktemp`; the atomic rename into place is unchanged.
nomarchy-theme-set already used a temp var for its home-state write — this
makes its system-state write consistent and cleans the temp up on failure.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

core/system/scripts/nomarchy-toggle-hybrid-gpu

@@ -9,7 +9,7 @@ STATE_FILE="/etc/nixos/state.json"
 # Check if supergfxd is enabled in config
 if [[ $(sudo jq -r '.features.hybridGPU // false' "$STATE_FILE") != "true" ]]; then
     if gum confirm "Hybrid GPU support is not enabled. Enable it now? (Requires sys-update)"; then
-        sudo jq '.features.hybridGPU = true' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
+        tmp=$(mktemp); sudo jq '.features.hybridGPU = true' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE"
         echo "Hybrid GPU support enabled in configuration. Applying changes..."
         sudo nomarchy-sys-update
         echo "Please run this command again after the update."