fix(docker): add writable /tmp to the scratch-based image

[sami-alajrami]

Kosli's temp-dir usage (directory fingerprinting, evidence tarballing) relies on os.MkdirTemp, which fails when /tmp doesn't exist at all, as is the case in the scratch base image. Stage an empty dir in the builder stage and copy it into the final image as a world-writable /tmp.

fixes kosli-dev/server#6508

Checklist

• Docs are autogenerated from CLI help — make sure the help text reflects your changes
• Helm chart (charts/k8s-reporter/) updated, if needed. Note: these changes live in a separate PR
• Terraform provider and related changes (terraform-provider-kosli, terraform-aws-evidence-reporter, terraform-aws-kosli-reporter) updated, if needed

[claude]

Claude finished @sami-alajrami's task in 49s —— View job

---

Review: add writable /tmp to the scratch-based image ✅

• Read the Dockerfile change
• Analyze correctness of the /tmp approach
• Post review feedback

This is a clean, well-scoped fix. Since the final image is FROM scratch, you can't RUN mkdir/chmod in it — staging an empty dir in the builder and copying it with --chmod is the correct idiomatic pattern for this. 👍

Correctness

• --chmod=1777 reproduces standard /tmp semantics (world-writable + sticky bit so processes can't delete each other's files). This matters because the container has no USER directive, so os.MkdirTemp may run as root or an arbitrary UID depending on how the image is invoked (docker run -u, Kubernetes runAsUser); 1777 keeps it writable in all cases.
• The # syntax=docker/dockerfile:1 directive at the top ensures BuildKit is used, which is required for COPY --chmod. So this is safe.
• os.TempDir() returns /tmp on Linux by default (unless $TMPDIR is set), so os.MkdirTemp will now resolve correctly. ✔️

Non-blocking observations

1. No automated regression guard. The failure this fixes (missing /tmp breaking os.MkdirTemp) can silently regress if the base image or COPY line changes later. Consider a tiny CI smoke step that runs the built image against an operation exercising temp-dir usage (e.g. a directory fingerprint or attest), so a broken /tmp fails the build rather than surfacing in production.
2. Minor: the mkdir -p /image-tmp step lands in the builder stage, so it doesn't affect the final image at all — no concern, just noting the -p is harmless here.

Security: 1777 is the correct, expected permission for /tmp; the sticky bit is present, so this doesn't weaken isolation beyond standard host /tmp behavior. No concerns.

Nice, minimal fix — LGTM.
• add-tmp-dir-to-docker-image