fix(macos): make signed smoke entitlements temp file unique

[Git-on-my-level]

Summary

• Fix the signed-artifact smoke entitlements mktemp template so BSD mktemp substitutes a trailing XXXXXX sequence.
• Add a hermetic regression test that invokes the production template twice and requires distinct files.

Product invariants affected

• INV-AUTH-1

Failure-Class

Failure-Class: none

Verification

• RED: cd desktop/macos && bash tests/test-signed-artifact-smoke.sh failed before the fix with mktemp: mkstemp failed on .../omi-entitlements.XXXXXX.plist: File exists.
• GREEN: cd desktop/macos && bash tests/test-signed-artifact-smoke.sh
• cd desktop/macos && bash -n scripts/smoke-signed-desktop-artifact.sh && bash -n tests/test-signed-artifact-smoke.sh && python3 scripts/check_desktop_test_quality.py
• python3 .github/scripts/check-release-process-guards.py
• python3 .github/scripts/test_check_desktop_auto_beta_candidate.py

[Git-on-my-level]

Closing as redundant: #10185 already merged the broader portable mktemp-template fix and its regression coverage. Keeping a second conflicting smoke fix would duplicate the release lane.

[github-actions]

Hey @Git-on-my-level 👋

Thank you so much for taking the time to contribute to Omi! We truly appreciate you putting in the effort to submit this pull request.

After careful review, we've decided not to merge this particular PR. Please don't take this personally — we genuinely try to merge as many contributions as possible, but sometimes we have to make tough calls based on:

• Project standards — Ensuring consistency across the codebase
• User needs — Making sure changes align with what our users need
• Code best practices — Maintaining code quality and maintainability
• Project direction — Keeping aligned with our product principles and locked invariants

Before your next PR, please skim:

• PRODUCT.md — product north star
• Product invariants — locked rules (shared chat, memory tiers, agent control plane, integrations, brand)

If this was declined for direction or taste, maintainers should cite an invariant ID or open a proposed one — ask if that citation is missing.

Your contribution is still valuable to us, and we'd love to see you contribute again in the future! If you'd like feedback on how to improve this PR or want to discuss alternative approaches, please don't hesitate to reach out.

Thank you for being part of the Omi community!