A builder's sandbox runs `bun install` and `bun x tsc --noEmit`: bun gets a writable temp directory #4136

Builders keep pushing without a type check. Pulls #4030 and #3843 say bun install and bun x tsc fail with 'bun is unable to write files to tempdir: ReadOnlyFileSystem', and both went red on errors tsc would have caught. src/crew/runner.ts sets TMPDIR and CLAUDE_CODE_TMPDIR to the run's temp directory, and installCacheEnv (src/crew/sandbox.ts) sets BUN_INSTALL_CACHE_DIR. Bun also needs BUN_TMPDIR, and a temp directory beside its cache that the sandbox lets it write.

Done:

• [ ] The run's env sets BUN_TMPDIR to the run's own writable temp directory, and the sandbox policy lets bun write wherever its install cache needs to write temp files.
• [ ] A test of the env and policy builder asserts BUN_TMPDIR is set, and that it is inside a path the policy makes writable.
• [ ] The pull quotes one real run (or scripts/sandbox-probe.ts) where bun install and bun x tsc --noEmit succeed in a fresh clone with no node_modules.

Files: src/crew/runner.ts, src/crew/sandbox.ts, a test. Risk: widening what the sandbox may write; keep it to the run's own directories. Before pushing: bun x tsc --noEmit and the tests named here.