`output-schema` with `runAsUser` fails to create temporary file

If output-schema input is passed to the action, resolveOutputSchema writes a temporary file.
https://github.com/openai/codex-action/blob/e0fdf01220eb9a88167c4898839d273e3f2609d1/src/runCodexExec.ts#L280-L284

When safety-strategy is unprivileged-user, createTempDir calls sudo -u ${runAsUser} mktemp -d -t ${prefix}.XXXXXX, which by default creates a directory with 0700 permission, only allowing the owner to be accessible.
https://github.com/openai/codex-action/blob/e0fdf01220eb9a88167c4898839d273e3f2609d1/src/runCodexExec.ts#L313-L321

However, as writeFile is performed by the process's user(runner), which even shares group with runAsUser user as per the guide, the write fails as group does not have access to the temp directory:

node:internal/fs/promises:637
  return new FileHandle(await PromisePrototypeThen(
                        ^

Error: EACCES: permission denied, open '/tmp/codex-output-schema-.wzM3U3/schema.json'
    at async open (node:internal/fs/promises:637:25)
    at async writeFile (node:internal/fs/promises:1219:14)
    at async resolveOutputSchema (/opt/actions-runner/_work/_actions/openai/codex-action/v1/dist/main.js:23599:7)
    at async runCodexExec (/opt/actions-runner/_work/_actions/openai/codex-action/v1/dist/main.js:23462:32)
    at async _Command.<anonymous> (/opt/actions-runner/_work/_actions/openai/codex-action/v1/dist/main.js:27802:7) {
  errno: -13,
  code: 'EACCES',
  syscall: 'open',
  path: '/tmp/codex-output-schema-.wzM3U3/schema.json'
}

Start in src/runCodexExec.ts at resolveOutputSchema and createTempDir, then compare the behavior with examples/unprivileged-user.yml. Run an unprivileged-user workflow using output-schema and verify that schema.json is created without an EACCES error.