fix(scripts): use mktemp for state.json writes, not a fixed /tmp path

Ten state-mutating sites across seven scripts wrote through a predictable,
world-writable temp path (`/tmp/state.json`, `/tmp/system-state.json`)
before the atomic `sudo mv`. Because the `>` redirect runs as the invoking
user (sudo doesn't cover redirects), the shared fixed path is a symlink/
TOCTOU target and collides if two of these run concurrently. Switch each
to a per-invocation `mktemp`; the atomic rename into place is unchanged.
nomarchy-theme-set already used a temp var for its home-state write — this
makes its system-state write consistent and cleans the temp up on failure.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

core/system/scripts/nomarchy-wifi-powersave

@@ -12,7 +12,7 @@ off) value="false" ;;
 *) echo "Usage: nomarchy-wifi-powersave <on|off>"; exit 1 ;;
 esac
 
-sudo jq --argjson val "$value" '.wifi.powersave = $val' "$STATE_FILE" > /tmp/state.json && sudo mv /tmp/state.json "$STATE_FILE"
+tmp=$(mktemp); sudo jq --argjson val "$value" '.wifi.powersave = $val' "$STATE_FILE" > "$tmp" && sudo mv "$tmp" "$STATE_FILE"
 
 echo "Wifi powersave set to $1. Applying changes..."
 sudo nomarchy-sys-update