fix(scripts): use mktemp for state.json writes, not a fixed /tmp path

Ten state-mutating sites across seven scripts wrote through a predictable,
world-writable temp path (`/tmp/state.json`, `/tmp/system-state.json`)
before the atomic `sudo mv`. Because the `>` redirect runs as the invoking
user (sudo doesn't cover redirects), the shared fixed path is a symlink/
TOCTOU target and collides if two of these run concurrently. Switch each
to a per-invocation `mktemp`; the atomic rename into place is unchanged.
nomarchy-theme-set already used a temp var for its home-state write — this
makes its system-state write consistent and cleans the temp up on failure.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

themes/engine/scripts/nomarchy-theme-set

@@ -40,7 +40,7 @@ jq --arg theme "$THEME_NAME" '.theme = $theme' "$STATE_FILE" > "$TMP_JSON" && mv
 # Sync to system state if we have permissions (for system-level theming like browser policies)
 SYSTEM_STATE_FILE="/etc/nixos/state.json"
 if [ -w "$SYSTEM_STATE_FILE" ] || [ -w "/etc/nixos" ]; then
-    sudo jq --arg theme "$THEME_NAME" '.theme = $theme' "$SYSTEM_STATE_FILE" > /tmp/system-state.json 2>/dev/null && sudo mv /tmp/system-state.json "$SYSTEM_STATE_FILE" 2>/dev/null || true
+    tmp=$(mktemp); sudo jq --arg theme "$THEME_NAME" '.theme = $theme' "$SYSTEM_STATE_FILE" > "$tmp" 2>/dev/null && sudo mv "$tmp" "$SYSTEM_STATE_FILE" 2>/dev/null || rm -f "$tmp"
 fi
 
 # Try to find a background for this theme