[codex-action] write temp output under RUNNER_TEMP

[viyatb-oai]

Summary

• Move implicit codex exec temp output files from /tmp to $RUNNER_TEMP
• Export the temp-root helper and guard main() so the behavior is testable
• Add a regression test covering RUNNER_TEMP precedence

Root Cause

The action created --output-last-message files under shared /tmp, which is writable from the Codex sandbox in the default workspace-write configuration. A symlink planted in that location could redirect the host-side final-message write to arbitrary files such as $GITHUB_ENV or $GITHUB_OUTPUT.

Validation

• pnpm test
• pnpm run check