Move test scratch artifacts out of the repo root

[t-kalinowski]

Summary

This moves test scratch directories out of the repository root so interrupted or failed test runs do not leave .tmp-* or similar artifacts in the working tree. The change keeps sandbox-sensitive scratch under target/test-scratch instead of OS temp because those tests need cwd writes to be blocked under read-only sandbox policy, and some timeout tests intentionally remove or override temp env paths.

User-facing changes

None. This only affects test scratch placement.

Internal changes

• Added a shared checkout-local scratch parent helper under target/test-scratch.
• Moved write-stdin and sandbox-state scratch dirs to that helper.
• Added regressions that assert scratch dirs are not created directly in the repo root and stay outside OS temp where required.
• Moved one worker-process unit-test scratch path to OS temp because it does not rely on sandbox cwd/temp semantics.