test(cli): use mkdtempSync for runtime-assets temp dir

CodeQL flagged js/insecure-temporary-file (high) on the test: it built a
temp dir from a predictable `Date.now()` name and wrote into it, which is
open to a temp-file race / symlink attack in the shared OS temp dir.

Use fs.mkdtempSync() to atomically create a uniquely-named directory with
a random suffix — the pattern CodeQL recognizes as safe — and drop the now
redundant mkdirSync. Behavior is otherwise unchanged; all 3 tests pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

packages/cli/test/runtime-assets.test.ts

@@ -13,11 +13,13 @@ import os from 'os';
 import path from 'path';
 import { createRuntimeAssetsPlugin } from '../src/utils/console.js';
 
-const assetsDir = path.join(os.tmpdir(), `os-test-runtime-assets-${Date.now()}`);
+// Atomically create a uniquely-named temp dir (random suffix) instead of a
+// predictable `Date.now()` name — avoids the temp-file race/symlink attack
+// flagged by CodeQL js/insecure-temporary-file.
+const assetsDir = fs.mkdtempSync(path.join(os.tmpdir(), 'os-test-runtime-assets-'));
 const testPng = path.join(assetsDir, 'test-logo.png');
 
 beforeAll(() => {
-  fs.mkdirSync(assetsDir, { recursive: true });
   fs.writeFileSync(testPng, Buffer.from('fake-png-content'));
 });