fix(test/releases-github): use mkdtemp to avoid cache-hit races

Two TOCTOU-protection tests in `downloadGitHubRelease` named their
scratch dir `test-github-dl-${Date.now()}`. Millisecond precision isn't
enough isolation: a prior run's cached `.version` + binary left behind
in `/tmp/test-github-dl-<prev>` could, under parallel worker scheduling
or same-ms retry, land at the same path as the next run's
`testDownloadDir`. The first `downloadGitHubRelease()` call then hit
the cache-hit branch (`existsSync(versionPath) && existsSync(binary)`)
instead of invoking `httpDownload`, causing the
`toHaveBeenCalledTimes(1)` assertion to fail with 0. Switches both
tests to `fs.mkdtemp`, which gives OS-guaranteed unique paths.

Author: jdalton

test/unit/releases-github.test.mts

@@ -842,8 +842,15 @@ describe('releases/github', () => {
       const { promises: fs } = await import('node:fs')
       const path = await import('node:path')
 
-      const tmpDir = tmpdir()
-      const testDownloadDir = path.join(tmpDir, `test-github-dl-${Date.now()}`)
+      // mkdtemp gives an OS-guaranteed unique dir. Previous `Date.now()`
+      // naming collided across test runs on the same millisecond and
+      // across parallel vitest workers, occasionally letting a prior
+      // run's cached .version + binary satisfy the cache-hit branch
+      // inside downloadGitHubRelease — so `httpDownload` was called 0
+      // times and the assertion below saw the wrong count.
+      const testDownloadDir = await fs.mkdtemp(
+        path.join(tmpdir(), 'test-github-dl-'),
+      )
 
       try {
         // Mock successful HTTP download
@@ -940,10 +947,10 @@ describe('releases/github', () => {
       const { promises: fs } = await import('node:fs')
       const path = await import('node:path')
 
-      const tmpDir = tmpdir()
-      const testDownloadDir = path.join(
-        tmpDir,
-        `test-github-dl-missing-${Date.now()}`,
+      // mkdtemp avoids collisions with prior test runs' leftover cache
+      // dirs. See note on the sibling test above.
+      const testDownloadDir = await fs.mkdtemp(
+        path.join(tmpdir(), 'test-github-dl-missing-'),
       )
 
       try {