fix(grok): default args/usage paths via tempfile.gettempdir() (bandit B108)

bandit B108 (hardcoded_tmp_directory) flagged the literal /tmp defaults for
GROK_ARGS_PATH and USAGE_OUT_PATH, failing 'make quality' (2 medium issues ->
Error 1) on master. Use tempfile.gettempdir() so there is no /tmp string
literal; the runtime path is unchanged (gettempdir() is /tmp in the Linux agent
container, matching the entrypoint's own ROBOCO_GROK_ARGS_FILE / tmp default).
Not silenced with # nosec. Verified: bandit -r roboco/ -ll now exits 0.

roboco/llm/providers/grok_cli_config.py

@@ -30,6 +30,7 @@ from __future__ import annotations
 
 import json
 import os
+import tempfile
 from pathlib import Path
 from typing import Any
 
@@ -64,7 +65,12 @@ BASH_GUARD_HOOK = os.environ.get(
     "ROBOCO_BASH_GUARD_HOOK", "/app/scripts/bash-guard-hook.sh"
 )
 # The entrypoint reads the computed flags (one token per line) from this file.
-GROK_ARGS_PATH = Path(os.environ.get("ROBOCO_GROK_ARGS_FILE", "/tmp/roboco-grok-args"))
+# Defaults under the system temp dir (not a hardcoded /tmp literal) — the
+# entrypoint reads the same ROBOCO_GROK_ARGS_FILE / tmp default.
+GROK_ARGS_PATH = Path(
+    os.environ.get("ROBOCO_GROK_ARGS_FILE")
+    or Path(tempfile.gettempdir()) / "roboco-grok-args"
+)
 
 # Hard ceiling on agentic turns (loop guard). Operator-tunable.
 _DEFAULT_MAX_TURNS = 200

roboco/llm/providers/grok_cli_usage.py

@@ -28,6 +28,7 @@ from __future__ import annotations
 import contextlib
 import json
 import os
+import tempfile
 from pathlib import Path
 from typing import Any
 from urllib.parse import quote
@@ -35,8 +36,10 @@ from urllib.parse import quote
 from roboco.billing.pricing import calculate_cost
 
 # Where the entrypoint writes the captured usage for the orchestrator to read.
+# Defaults under the system temp dir (not a hardcoded /tmp literal).
 USAGE_OUT_PATH = Path(
-    os.environ.get("ROBOCO_GROK_USAGE_FILE", "/tmp/roboco-grok-usage.json")
+    os.environ.get("ROBOCO_GROK_USAGE_FILE")
+    or Path(tempfile.gettempdir()) / "roboco-grok-usage.json"
 )