fix(tools): store malformed Write payloads under .bitfun/tmp

[wsp1911]

Summary

• Store malformed Write payloads under .bitfun/tmp with a deterministic suffix derived from the last 12 alphanumeric characters of the tool-call ID.
• Keep the fallback path aligned with its file permission resource and update the recovery guidance and tests.
• Create parent directories before remote SSH workspace writes so nested fallback paths work remotely.

Type and Areas

Type:

Bug fix

Areas:

Rust core, remote SSH workspace services

Motivation / Impact

Malformed Write payloads no longer create temporary files in the workspace root. Their fallback paths retain deterministic permission identity while preserving the entropy typically found at the end of provider tool-call IDs.

Remote workspace writes now support nested output paths when their parent directories do not already exist.

Verification

• pnpm run fmt:rs — passed
• git diff --check — passed
• cargo test -p bitfun-core fallback_file_path_uses_workspace_tmp_directory_and_tool_call_id_suffix --lib -- --exact — passed

Reviewer Notes

• The fallback file name is .bitfun/tmp/write_{suffix}.tmp; {suffix} is the last 12 ASCII alphanumeric characters of the tool-call ID.
• Deterministic naming is required because file permission intents are calculated before the write executes.
• The remote SSH parent-directory creation applies to all RemoteWorkspaceFs writes, matching local workspace write behavior.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, including the timed-out Rust test.
• User-facing Write recovery guidance and its corresponding tests are updated.