fix(env-probe): capture probe output via temp files so descendants can't stall the read (#67964 follow-up)

[teknium1]

Summary

Salvage of #67991 by @PRATHAMESH75: the env probe now captures subprocess output through temp files instead of pipes, so timeout bounds the whole call and a lingering pipe-holding descendant can't stall the probe at all — improving on the tree-kill approach merged in #67999 for the same bug (#67964).

Why this is better than what #67999 shipped in _run: temp files have no reader threads, so wait() only ever waits on the direct child. A fast pip that leaves a lingering descendant now returns its real output in milliseconds (probe line survives), where the pipe-based path burned the full 3s timeout and discarded the output. The _kill_process_tree helper from #67999 becomes unnecessary and is removed; the fail-open worker/event layer around callers (also from #67999) stays — it guards against any future probe hang class.

Changes

• tools/env_probe.py::_run — capture via tempfile.TemporaryFile for stdout/stderr; on TimeoutExpired return immediately (no pipe read possible); _kill_process_tree removed (cherry-picked from fix(tools): bound env probe subprocess so a Windows inherited pipe can't wedge sessions (#67964) #67991, conflict-resolved on top of fix(env-probe): stuck Windows probe can no longer deadlock system-prompt builds #67999)
• tests/tools/test_env_probe.py — contributor's TestRunBoundedByTimeout: fast child + 20s pipe-holding grandchild must return the child's real output within milliseconds, not the timeout

Validation

	Pipe capture (#67999)	Temp-file capture (this PR)
Fast pip + lingering descendant (E2E, real shim)	3s timeout burned, output lost	real output in 0.03s
Fully hung pip, 4 concurrent sessions (E2E)	bounded, 3.2s, fail open	bounded, 3.2s, fail open
tests/tools/test_env_probe.py	14 tests	15 tests, green
tests/run_agent/test_run_agent.py	—	451/451 green (combined run)

Contributor authorship preserved via cherry-pick; merge with rebase.

Credit: @PRATHAMESH75 submitted the temp-file capture mechanism in #67991 before #67999 was opened.

Infographic