[FEATURE]: Provide a default pre-approved temp directory for skills/tools writing outside the workspace

Feature hasn't been suggested before.

• I have verified this feature I'm about to request hasn't been suggested before.

Describe the enhancement you want to request

Problem

Skills and tools often need to write temporary artifacts outside the workspace (for example, creating a temporary git worktree via mktemp -d to keep the user's working tree read-only, or staging scratch files during a multi-step task).

opencode currently pre-approves a single, machine/user-specific path (e.g. /var/folders/kc/.../T/opencode) for external directory access. A portable skill cannot know that path ahead of time, so it falls back to mktemp -d (or $TMPDIR), which lands outside the pre-approved area and triggers a permission prompt — or is blocked.

The same skill runs without friction in other coding agents that don't restrict temp paths.

Request

Make a standard temp location the default behavior so skills don't need per-agent workarounds. For example:

1. Expose a documented, pre-approved temp directory via an environment variable (e.g. OPENCODE_TMPDIR) that tools/skills can read.
2. Pre-approve mktemp -d / $TMPDIR writes by default (or a well-known subdir under it) instead of a single hard-coded path.
3. Keep it portable and per-user, so a skill can just use the default mktemp -d without hard-coding a machine-specific path.

Why it matters

Multi-agent skills should not need opencode-specific branches. A standard, always-available temp dir keeps skills portable and removes an avoidable permission prompt.