fix: keep temporary copies on their volume

[janicduplessis]

Description

Large worktree and app copies on another volume can silently materialize in system temp and exhaust the internal disk. Staging stays outside Git working trees to preserve secret-file protection.

Solution

Select private, writable staging on the operation's volume for warming, app preparation, release swaps, and fingerprint checks. STIM_TMPDIR or machine tempDir can override placement. Doctor reports when that override or the build-cache layout requires full cross-volume copies. Failed swaps remove their staging directories.

Test plan

• Added a macOS end-to-end test using a disposable APFS image: warm stays on the destination volume with both normal cloning and forced copy fallback; an override on the internal volume produces doctor findings.
• Verified copy stages across two APFS volumes: automatic staging shares blocks; a cross-volume override makes full copies. Mobile builds were not tested.
• All 3,575 unit tests and 66 end-to-end tests pass.

Fixes #431.