fix(lint): deterministic staging dir via os.Mkdir 0755 instead of MkdirTemp+Chmod

Installs are mutex-serialized and leftovers are swept pre-install, so a
random suffix bought nothing; CI's gosec also rejected the Chmod (G302)
that MkdirTemp's 0700 forced.

Author: ysyneu

environment/environment.go

@@ -1112,15 +1112,13 @@ func (e *Environment) SyncSkill(ctx context.Context, args *protocol.SyncSkillArg
 			_ = os.RemoveAll(d)
 		}
 	}
-	tmpDir, err := os.MkdirTemp(parentDir, ".installing-"+args.SkillName+"-")
-	if err != nil {
-		return nil, fmt.Errorf("failed to create staging directory: %w", err)
+	// Deterministic staging name is safe: installs are serialized by
+	// skillInstallMu and the sweep above just cleared any leftover.
+	tmpDir := filepath.Join(parentDir, ".installing-"+args.SkillName)
+	if mkErr := os.Mkdir(tmpDir, 0o755); mkErr != nil {
+		return nil, fmt.Errorf("failed to create staging directory: %w", mkErr)
 	}
 	defer func() { _ = os.RemoveAll(tmpDir) }() // no-op after a successful rename
-	// MkdirTemp creates 0700; restore the 0755 the install dir always had.
-	if chmodErr := os.Chmod(tmpDir, 0o755); chmodErr != nil { // #nosec G302 -- skill dirs are world-traversable by design (G301 excluded for the same reason)
-		return nil, fmt.Errorf("failed to chmod staging directory: %w", chmodErr)
-	}
 	if err := e.unzipSkill(zipData, tmpDir); err != nil {
 		return nil, fmt.Errorf("failed to unzip skill: %w", err)
 	}