bwrap: reset TMPDIR/TMP to /tmp inside the sandbox

bwrap inherits the server's environment; on hosts with pam_tmpdir that
includes TMPDIR=/tmp/user/<uid>, which does not exist on the sandbox's
fresh tmpfs /tmp. Every tool honoring TMPDIR then fails — seen live on
mih34 as go's 'creating work dir: stat /tmp/user/120957: no such file
or directory'. The JVM ignores TMPDIR, so Gradle builds never noticed.
Explicit environment and bwrap.env entries can still override.

(Werkdock's own engine is immune by design: it runs --clearenv.)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/main/kotlin/de/hoennig/werkator/build/BwrapBuildRunner.kt

@@ -200,6 +200,14 @@ class BwrapBuildRunner(
         args += listOf("--ro-bind", "/etc/resolv.conf", "/etc/resolv.conf")
         args += listOf("--proc", "/proc", "--dev", "/dev", "--tmpfs", "/tmp")
         args += listOf("--setenv", "HOME", "/root")
+        // The sandbox /tmp is a fresh tmpfs, but bwrap inherits the server's
+        // environment — on hosts with pam_tmpdir that includes
+        // TMPDIR=/tmp/user/<uid>, which does not exist inside and breaks every
+        // tool honoring it (go: "creating work dir: stat ...: no such file or
+        // directory"; the JVM ignores TMPDIR, so Gradle never noticed). Set
+        // both back to /tmp; explicit env below can still override.
+        args += listOf("--setenv", "TMPDIR", "/tmp")
+        args += listOf("--setenv", "TMP", "/tmp")
         for ((key, value) in environment) {
             args += listOf("--setenv", key, value)
         }

src/test/kotlin/de/hoennig/werkator/build/BwrapBuildRunnerTest.kt

@@ -104,6 +104,12 @@ class BwrapBuildRunnerTest : FunSpec() {
                     "HOME",
                     "/root",
                     "--setenv",
+                    "TMPDIR",
+                    "/tmp",
+                    "--setenv",
+                    "TMP",
+                    "/tmp",
+                    "--setenv",
                     "branch",
                     "main",
                     "--chdir",