fix(scripts): use mktemp for state.json writes, not a fixed /tmp path

Ten state-mutating sites across seven scripts wrote through a predictable,
world-writable temp path (`/tmp/state.json`, `/tmp/system-state.json`)
before the atomic `sudo mv`. Because the `>` redirect runs as the invoking
user (sudo doesn't cover redirects), the shared fixed path is a symlink/
TOCTOU target and collides if two of these run concurrently. Switch each
to a per-invocation `mktemp`; the atomic rename into place is unchanged.
nomarchy-theme-set already used a temp var for its home-state write — this
makes its system-state write consistent and cleans the temp up on failure.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

core/system/scripts/nomarchy-tz-select

@@ -7,7 +7,7 @@ STATE_FILE="/etc/nixos/state.json"
 
 timezone=$(timedatectl list-timezones | gum filter --height 20 --header "Set timezone") || exit 1
 
-sudo jq --arg tz "$timezone" '.timezone = $tz' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
+tmp=$(mktemp); sudo jq --arg tz "$timezone" '.timezone = $tz' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE"
 
 echo "Timezone is now set to $timezone. Applying changes..."
 sudo nomarchy-sys-update