macos secrets: use Lwt_io.with_temp_dir for staging

[mtelvers]

• Filename.temp_dir is 5.1+; workers run 4.14. Switched to Lwt_io.with_temp_dir, matching sandbox.runc/jail/hcs/docker_sandbox.
• Staging dir now cleaned up on failure and cancellation, not just success.
• Dir perms 0o755 → 0o711 so other local users can't enumerate secret filenames.

Test

((from macos-homebrew-ocaml-5.4)
 (user (uid 1000) (gid 1000))
 (run (secrets (alpha (target /run/secrets/alpha))
                (beta  (target /run/secrets/beta)))
      (shell "set -eu; \
              echo \"OBUILDER_SECRETS_DIR=\$OBUILDER_SECRETS_DIR\"; \
              test \"\$(cat \"\$OBUILDER_SECRETS_DIR/alpha\")\" = 'hello-alpha'; \
              test \"\$(cat \"\$OBUILDER_SECRETS_DIR/beta\")\" = 'hello-beta'; \
              ls -la \"\$OBUILDER_SECRETS_DIR\" 2>&1 | head -5 || true; \
              echo OK"))
)

$ ocluster-client submit-obuilder -c mtelvers.cap --pool=macos-arm64 \
    --local-file=test_secrets.spec \
    --secret=alpha:alpha.txt --secret=beta:beta.txt

Building on m1-worker-04
OBUILDER_SECRETS_DIR=/tmp/obuilder-macos-secrets-d1d761
ls: /tmp/obuilder-macos-secrets-d1d761: Permission denied
total 0
OK
Job succeeded

ocurrent/obuilder#207