[HIGH] Pin tmp to 0.2.7

[OskarEichler]

Summary

• resolve external-editor’s tmp dependency to 0.2.7
• remove the obsolete os-tmpdir transitive dependency
• keep the change scoped to the existing Inquirer toolchain

Security impact

tmp 0.0.33 is affected by GHSA-ph9p-34f9-6g65, a high-severity path traversal through unsanitized prefix/postfix values, and GHSA-52f5-9888-hmc6, a symlink-based arbitrary temporary file/directory write. The targeted resolution is necessary because current external-editor still requests tmp ^0.0.33.

Test Plan

• yarn install --frozen-lockfile --ignore-scripts
• yarn why tmp confirmed only 0.2.7
• yarn audit no longer reports tmp advisories
• temporary-file create/remove lifecycle check
• yarn build
• git diff --check

Changelog:

[INTERNAL] [SECURITY] - Pin tmp to 0.2.7.