Create the batch temp directory privately and fail if it exists

[sirbrillig]

Fixes #120.

The batch scan built its temp root from uniqid(), ignored the mkdir() return value, and created every directory with the default 0777 & ~umask:

$tempDir = sys_get_temp_dir() . '/phpcs-changed-' . uniqid();
mkdir($tempDir);

uniqid() is derived from the current microtime, so the path is guessable. On a shared machine (CI runner, shared build box) another local user can pre-create the predicted directory with new and old as symlinks; because the failed mkdir() was ignored, the batch then writes git or svn file contents through those symlinks, or tampers with the copies between creation and the single phpcs run that gates a commit. Even with no attacker present, the 0777 directories exposed copies of the scanned source to other local users for the duration of the scan. CWE-377 / CWE-378.

Changes

Both batch entry points now share a createTempDir() helper that names the directory from random_bytes(16), creates it with mode 0700, and throws a ShellException if mkdir() fails rather than continuing into a directory it does not own. writeTempFile()'s nested mkdir($dir, 0777, true) is likewise 0700 and checked.

The temp files themselves are still created by shell redirection and so land at the umask default; the 0700 parent is what keeps them private.

Testing

Two tests in GitWorkflowTest, driven through the existing mocked-shell batch path:

• testFullGitWorkflowCreatesBatchTempDirsPrivateToTheCurrentUser — asserts every directory in the batch tree is 0700.
• testFullGitWorkflowNamesTheBatchTempDirUnpredictably — asserts the root matches phpcs-changed-[0-9a-f]{32}.

The batch deletes the whole tree in a finally before returning, so the directories cannot be inspected after the fact. TestShell/WindowsTestShell now record each temp directory's permissions as writeCommandOutputToFile is called, which is the point where the tree exists. Both tests fail on trunk and pass with this change.

composer precommit passes: 165 tests / 270 assertions, phpcs clean, psalm no errors.

Follow-up, not fixed here

Temp paths are built as $tempDir . '/new/' . ltrim($fileName, '/'), and file names reach that point exactly as typed on the command line — nothing calls realpath() on them. A relative argument containing .. therefore places the temp copy outside the batch directory:

/tmp/phpcs-changed-abc/new/../../evil.php

which resolves to /tmp/evil.php — outside the tree cleanupTempDir() removes, and able to clobber an existing file there. It is not a privilege boundary, since the user is scanning their own files as themselves, but it writes and leaks files outside the temp dir. Filed separately.