Harden CLI smoke temp directory fallback

[Evilander]

Summary

• make scripts/smoke-cli.js try AUDREY_SMOKE_TMPDIR, the OS temp directory, then a repo-local .tmp fallback
• keep the smoke command usable on hosts where %TEMP% points at a stale or inaccessible path
• preserve the existing CLI checks and cleanup behavior

Verification

• Fresh checkout at b8fa7b657047ea6c88847a7a02fa0f89990d2653
• npm ci
• npm run release:gate:sandbox progressed through build, typecheck, perf, memory, GuardBench, publication verification, and Python release checks; original failure was EPERM: mkdtemp 'L:\caches\temp\audrey-smoke-XXXXXX'
• After patch: npm run smoke:cli passed with the same bad host %TEMP%
• npm run security:audit passed, 0 vulnerabilities
• npm run pack:check passed

Risk

• Low. Changes only the smoke-test temp directory selection path; runtime package behavior is unchanged.