[HIGH] Pin tmp to 0.2.7

[OskarEichler]

Summary

• resolve external-editor’s tmp dependency to 0.2.7
• remove the obsolete os-tmpdir transitive dependency
• keep the change scoped to the existing Inquirer toolchain

Security impact

tmp 0.0.33 is affected by GHSA-ph9p-34f9-6g65, a high-severity path traversal through unsanitized prefix/postfix values, and GHSA-52f5-9888-hmc6, a symlink-based arbitrary temporary file/directory write. The targeted resolution is necessary because current external-editor still requests tmp ^0.0.33.

Verification

• yarn install --frozen-lockfile --ignore-scripts
• yarn why tmp confirmed only 0.2.7
• yarn audit no longer reports tmp advisories
• temporary-file create/remove lifecycle check
• yarn build
• git diff --check

[github-actions]

Warning

Missing Test Plan

Please add a "## Test Plan" section to your PR description. A Test Plan lets us know how these changes were tested.

Caution

Missing Changelog

Please add a Changelog to your PR description. See Changelog format