mktemp silently changes its returned filename under strict replay #1464

mktemp silently generates a new filename under strict replay. The recording
contains A p="/tmp/eigen_…" but no N mktemp=…, and replay exits 0 with
different stdout. This contradicts TRACE.md's byte-identical-output contract
and the principle Determinism is a guarantee with a stated boundary.

Found while comparing the #1425/#1444 operator-line round against ea9ee90;
the behavior reproduces on that base and the candidate, so it is outside that
fix. It also makes tests/test_coverage_gaps.eigs's A sfile and A tfile
records differ even after replay pins the N stream.

Minimal repro:

p is mktemp of null
print of p
removed is rm of p

EIGS_JIT_OFF=1 EIGS_TRACE=/tmp/mktemp.tape src/eigenscript /tmp/mktemp.eigs
EIGS_JIT_OFF=1 EIGS_REPLAY=/tmp/mktemp.tape EIGS_REPLAY_STRICT=1 src/eigenscript /tmp/mktemp.eigs

Measured on ea9ee90: record rc=0 prints /tmp/eigen_wCjks0; replay rc=0
prints /tmp/eigen_jL82r0; N mktemp records=0. Candidate independently
reproduces the same mismatch. builtin_mktemp directly calls mkstemp in
src/builtins_host.c, without a taped return or replay refusal.

Done when:

• Choose and document whether mktemp has a taped return or is a named
  replay boundary, accounting for its file-creation side effect.
• Strict replay of the repro returns the recorded filename, or refuses
  with the documented boundary error; it never succeeds with a fresh name.
• Add a regression that fails on the current behavior in the replay gate.
• Preserve ordinary mktemp file creation and cleanup behavior.