fix(plugin-runtime): write desktop command output to the OS temp dir

[Agnik47]

Problem

makeScreenshotCommand and makeDumpCommand in src/plugin-runtime.ts — both
part of the public @agentrhq/webcmd/plugin-runtime surface — hardcode
/tmp/<site>-* as their output destination.

/tmp is not a temp directory on Windows. Node resolves it against the current
drive root:

path.resolve('/tmp/x-dom.html')  // → D:\tmp\x-dom.html
os.tmpdir()                      // → C:\Users\<user>\AppData\Local\Temp

So on Windows <site> screenshot and <site> dump silently mkdirSync a stray
\tmp folder at the root of whichever drive the process happens to run from, and
fail with EPERM when that root is not writable for the current user (the common
case for a non-elevated user on C:\).

The repo supports Windows deliberately — win32 branches already exist in
plugin.ts, discovery.ts, skills.ts, external.ts and errors.ts — so these
two defaults are the odd ones out.

Fix

Use os.tmpdir() for both defaults and for the --output help text. Five lines in
src/plugin-runtime.ts. Behaviour is unchanged on Linux (os.tmpdir() is /tmp),
and an explicit output argument is still honoured exactly as before.

Tests

• The existing desktop command factories test was asserting the /tmp literals
  itself, so it is rewritten against os.tmpdir().
• New test defaults screenshot and dump output to the OS temp dir: relocates the
  temp directory through TMPDIR (POSIX) / TEMP+TMP (Windows) — os.tmpdir()
  reads those on every call, so no builtin-module mocking is needed — then asserts
  the help text, both returned paths, and every file actually written land inside
  it. This fails on Linux too, not just Windows.

Verification

• npx vitest run --project unit src/plugin-runtime.test.ts → 15 passed.
• Stashed the src/plugin-runtime.ts change and re-ran the same file → 2 failed,
  reporting /tmp/runtime-test-… against the expected temp dir, confirming the new
  test genuinely catches the regression rather than passing vacuously.
• npx tsc --noEmit → clean.
• Grepped docs/, skills/, skill-src/, mcp-skills/ and plugins/ for these
  paths — nothing documents them, so no docs change is needed.

Deliberately out of scope

src/browser/command-catalog.ts:25 also mentions /tmp/upload.pdf, but that is a
help-text example of a caller-supplied path, not a destination webcmd writes to.

[github-actions]

🟠 Maintainer review suggested — low confidence

The automated review could not reach a fully supported conclusion.

Limitations

• The automated review returned an invalid structured result.

This review is advisory and does not block merging.