fix(security): harden the root-run template writer and the search worker

Two more code-scanning findings that are real, plus notes on the ones that
are not.

CodeQL #91 (high, js/insecure-temporary-file) — ops/lib/render-template.js
staged at `<dir>/.<basename>.<pid>.<now>.tmp`. `apple-docs-ops install`
runs this AS ROOT while the surrounding tree is operator-owned, so a
predictable staging name is an escalation vector: anyone able to create
entries in that directory can pre-place a symlink and have root write
through it. O_EXCL closes the race but not the prediction. Now stages in a
mkdtemp directory (kernel-random, mode 0700) inside the target directory,
so the rename stays atomic and neither the file nor its parent is
guessable. Cleanup moved to `finally`.

CodeQL #24/#25/#26 (medium, js/client-side-request-forgery) —
search-worker.js interpolated `manifest.files[...]` straight into the fetch
URL. The manifest is same-origin so this was not exploitable, but a
malformed or tampered build artifact carrying `/`, `..` or a scheme could
steer the index load off the data directory. Manifest values are now
data, not path fragments: a bare `[A-Za-z0-9._-]+` filename or the
unhashed default. Defence in depth on a shipped runtime path.

CodeQL #23 (js/missing-origin-check) — documented in place rather than
"fixed": this is a DEDICATED worker, so the only possible sender is the
document that constructed it and `event.origin` is always ''. There is no
origin to check. The value that matters, `base`, is already pinned to the
worker's own origin by validateBase().

The worker's exempt baseline moves 411 → 423. Unlike the database.js case,
this growth belongs where it landed — a Web Worker cannot import, so a
guard for worker input has nowhere else to live.

Suite: 2528 pass, 16 skip, 0 fail.