runtime-host control endpoint hardcodes /tmp and sweeps same-rootId directories on startup

[jackwener]

Found during Slock task #147 investigation (unrelated to the flakes, structurally real).

packages/runtime-host/src/control/endpoint.ts:4:

const POSIX_ENDPOINT_ROOT = '/tmp';   // hardcoded, ignores os.tmpdir()

Two problems:

1. The parallel test runner assigns each workspace an isolated TMPDIR (run-workspace-tests-parallel.mjs:87) — this path bypasses it.
2. removeStaleEndpointDirectories() (endpoint.ts:94) deletes ALL /tmp directories matching the same rootId prefix before each host start. Measured up to 6 concurrent m-<uid>-… endpoint dirs during a parallel run. Two hosts with the same rootId starting concurrently: the later one deletes the earlier one's live socket directory. Tests currently survive only because each withHostPaths uses a distinct mkdtemp rootId — safety by coincidence, not by design.

Ask: read os.tmpdir() (honoring TMPDIR), and scope stale-cleanup to provably-dead directories (pidfile/lock heuristic) rather than same-prefix sweep.

[Benjamin-eecs]

Taking this one.

• Endpoint root from os.tmpdir(), falling back to /tmp when the socket path would not fit the portable sun_path limit. The current directory name only fits under /tmp, so nested TMPDIR runners need the fallback.
• The startup sweep becomes liveness-aware: each directory carries an ownership marker, and only provably-dead directories are removed. A live same-rootId sibling is never deleted.
• Dedicated unit tests: preparation, the length fallback, live-vs-dead sweep behavior, and the existing 0700/0600 checks.