fix(file-tools): allow writes to platform temp directory on macOS

[yy7yy7kimo-code]

macOS resolves /var/folders/ to /private/var/folders/ which is blocked by the /private/var/ sensitive-system path guard. Adds _is_allowed_temp_path() to explicitly allow platform temp directory writes.

[alt-glitch]

Likely duplicate of #13733 which addresses the same macOS temp dir write blocking in file_tools.py. Both fix the /private/var/folders/ sensitive-path guard. Also related to closed #11983.

[teknium1]

Thanks for isolating the macOS temp-directory false positive. The issue is still present on current main: tools/file_tools.py:635-675 blocks task-resolved /private/var/folders/... paths through the broad /private/var/ prefix.

Problems

• tools/file_tools.py (PR right-side line 181): returning from _check_sensitive_path() here skips the exact-path and Hermes-config protections below it. Current tests/tools/test_file_tools.py:596-630 requires a config file under a temporary directory to remain blocked for both write_file_tool and patch_tool; this implementation would permit it when it is below tempfile.gettempdir().
• The PR has no regression coverage for the macOS temp-root path or for retaining those protections. tests/tools/test_file_write_safety.py:171-196 currently covers /private/var/db blocking and normal /tmp allowance only.

Suggested changes

• Skip only the broad _SENSITIVE_PATH_PREFIXES scan for a verified resolved temp path; continue to the exact-path and Hermes-config checks.
• Add allow/block regression cases for macOS temp paths and for a config path beneath the temp root.

Automated hermes-sweeper review.

[teknium1]

This early return also skips the exact-path and Hermes-config guards below. tests/tools/test_file_tools.py:596-630 requires a config located under a temporary directory to remain blocked for both write and patch; exempt only the broad prefix loop, then continue through the remaining checks.