bwrap: reset TMPDIR/TMP to /tmp inside the sandbox

bwrap inherits the server's environment; on hosts with pam_tmpdir that
includes TMPDIR=/tmp/user/<uid>, which does not exist on the sandbox's
fresh tmpfs /tmp. Every tool honoring TMPDIR then fails — seen live on
mih34 as go's 'creating work dir: stat /tmp/user/120957: no such file
or directory'. The JVM ignores TMPDIR, so Gradle builds never noticed.
Explicit environment and bwrap.env entries can still override.

(Werkdock's own engine is immune by design: it runs --clearenv.)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/test/kotlin/de/hoennig/werkator/build/BwrapBuildRunnerTest.kt

@@ -104,6 +104,12 @@ class BwrapBuildRunnerTest : FunSpec() {
                     "HOME",
                     "/root",
                     "--setenv",
+                    "TMPDIR",
+                    "/tmp",
+                    "--setenv",
+                    "TMP",
+                    "/tmp",
+                    "--setenv",
                     "branch",
                     "main",
                     "--chdir",