fix(scripts): use mktemp for temp paths (closes 3 panic-attack path-traversal findings) (#185)

## Summary

Three scripts wrote to or read from hard-coded `/tmp/*` paths —
panic-attack flags as path-traversal / TOCTOU low (any local user on a
shared CI or workstation can race the file between write and read, or
pre-create a symlink to clobber the target).

- `scripts/balance_corpus.sh` — write listing to `$(mktemp)` + trap rm
- `scripts/balance_corpus_fast.sh` — write listing to `$(mktemp)` + trap
rm
- `scripts/gen-provers-a2ml.sh` — accept variant-list path as `$1` (was
hard-coded `/tmp/provers-list.txt`); callers should pass `$(mktemp)` or
any path they control. Adds usage banner + early-exit on
missing/unreadable arg.

## Test plan

- [x] `bash -n` syntax-check passes on all three scripts
- [x] `gen-provers-a2ml.sh` against a populated `$(mktemp)` emits the
expected `[prover.<Variant>]` blocks with snake_case slugs and correct
`count = N` header
- [x] empty-arg invocation prints usage to stderr and exits 2 instead of
silently producing `count = 0`
- [ ] CI green (rust-ci / governance / scans)

Does not touch in-flight PRs (#176/#178/#179/#182 — none of them edit
the scripts directory).

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

scripts/balance_corpus.sh

@@ -24,11 +24,15 @@ fi
 REPLICA_DIR="$CORPUS_DIR/replica"
 mkdir -p "$REPLICA_DIR"
 
-# Get a list of all files with the specified extension
-find "$CORPUS_DIR" -name "*$EXTENSION" > /tmp/corpus_files.txt
+# Get a list of all files with the specified extension.
+# Use mktemp for the listing file: predictable /tmp/* paths are a
+# panic-attack low (path-traversal / TOCTOU on multi-user runners).
+CORPUS_LIST="$(mktemp)"
+trap 'rm -f "$CORPUS_LIST"' EXIT
+find "$CORPUS_DIR" -name "*$EXTENSION" > "$CORPUS_LIST"
 
 # Read the list into an array
-mapfile -t FILES < /tmp/corpus_files.txt
+mapfile -t FILES < "$CORPUS_LIST"
 
 # Replicate files in batches to avoid timeout
 echo "Starting replication of $FILES_TO_ADD files for $CORPUS_DIR..."

scripts/balance_corpus_fast.sh

@@ -24,11 +24,15 @@ fi
 REPLICA_DIR="$CORPUS_DIR/replica"
 mkdir -p "$REPLICA_DIR"
 
-# Get a list of all files with the specified extension
-find "$CORPUS_DIR" -name "*$EXTENSION" > /tmp/corpus_files.txt
+# Get a list of all files with the specified extension.
+# Use mktemp for the listing file: predictable /tmp/* paths are a
+# panic-attack low (path-traversal / TOCTOU on multi-user runners).
+CORPUS_LIST="$(mktemp)"
+trap 'rm -f "$CORPUS_LIST"' EXIT
+find "$CORPUS_DIR" -name "*$EXTENSION" > "$CORPUS_LIST"
 
 # Read the list into an array
-mapfile -t FILES < /tmp/corpus_files.txt
+mapfile -t FILES < "$CORPUS_LIST"
 
 # Replicate files in smaller batches to avoid timeout
 echo "Starting replication of $FILES_TO_ADD files for $CORPUS_DIR..."

scripts/gen-provers-a2ml.sh

@@ -1,8 +1,22 @@
 #!/bin/bash
 # Generate provers.a2ml from a variant list.
 # Snake-case conversion: PascalCase -> snake_case (matches serde default).
+#
+# Usage: gen-provers-a2ml.sh <variant-list-file>
+#
+# The variant-list path is a CLI argument (was the hard-coded
+# /tmp/provers-list.txt); predictable /tmp/* paths are a panic-attack
+# low (path-traversal / TOCTOU on multi-user runners). Callers should
+# pass `$(mktemp)` or any path they control.
 set -euo pipefail
 
+VARIANT_LIST="${1:-}"
+if [ -z "$VARIANT_LIST" ] || [ ! -r "$VARIANT_LIST" ]; then
+  echo "usage: $0 <variant-list-file>" >&2
+  echo "  (one PascalCase variant per line; e.g. \"$(mktemp)\" populated by caller)" >&2
+  exit 2
+fi
+
 cat << 'HEADER'
 # SPDX-License-Identifier: MPL-2.0
 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
@@ -28,7 +42,7 @@ source  = "src/rust/provers/mod.rs::ProverKind"
 date    = "2026-04-24"
 HEADER
 
-printf "count   = %d\n\n" "$(wc -l < /tmp/provers-list.txt)"
+printf "count   = %d\n\n" "$(wc -l < "$VARIANT_LIST")"
 
 while IFS= read -r variant; do
   # snake_case: lowercase + insert underscore before uppercase letter that
@@ -38,4 +52,4 @@ while IFS= read -r variant; do
   echo "[prover.${variant}]"
   echo "slug = \"${slug}\""
   echo ""
-done < /tmp/provers-list.txt
+done < "$VARIANT_LIST"