fix(security): use isolated temp directory in spm.sh scripts [DEVA11Y-483]

[sunny-se]

Summary

• F-014 / DEVA11Y-483 — Concurrent spm.sh instances shared CWD, causing the EXIT-trap cleanup() to delete a sibling instance's Package.swift / Package.resolved (CWE-362 race condition).
• Replaced in-place file creation with mktemp -d per invocation so each run gets an isolated working directory.
• Applied identically to all 3 shell variants:
  • scripts/bash/spm.sh
  • scripts/zsh/spm.sh
  • scripts/fish/spm.sh

What changed

Before	After
PACKAGE_EXISTS exit-code flag ($?)	HAS_EXISTING_PACKAGE boolean (0/1)
Package.swift written to shared $PWD	Written to $WORK_DIR via mktemp -d
cleanup() deletes $PWD/Package.swift	cleanup() does rm -rf $WORK_DIR (temp dir only)
swift package plugin runs in $PWD	Runs in $WORK_DIR after cd

When a pre-existing Package.swift is detected, WORK_DIR points to the original directory and cleanup is skipped — preserving backward compatibility.

Test plan

• Run single spm.sh invocation — verify scan completes, temp dir cleaned up
• Run two concurrent spm.sh instances in same CWD — verify neither deletes the other's Package.swift
• Run in a project that already has Package.swift — verify existing file untouched

Jira: DEVA11Y-483

🤖 Generated with Claude Code