set private per-user tmpdir

[moss4u]

Summary

Configure omarchy to use a private per-user temporary directory at ~/.local/tmp via $TMPDIR.

This avoids using the shared 1777 /tmp namespace for applications that respect $TMPDIR, while preserving /tmp for compatibility.

Implementation

• creates ~/.local/tmp
• sets TMPDIR=${HOME}/.local/tmp for systemd user sessions
• sets the equivalent PAM environment value for contexts such as ssh
• adds a user tmpfiles policy to clean files older than 10 days
• enables the user systemd-tmpfiles-clean.timer
• adds migration support for existing installations
• users and user-tools are encouraged to use TMPDIR

The corresponding omarchy-settings change adds .local/tmp to /etc/skel for newly created users.

Rationale

The main benefit is removing compliant applications from the globally writable /tmp namespace, reducing exposure to classes of temporary-file bugs involving shared namespaces, predictable paths, symlink attacks, and related races.

MacOS has also taken similar steps using /var/folders/...