Preserve SELinux labels for atomic file writes

[Copilot]

Node bootstrap can fail on SELinux-enforcing hosts when atomic writes create temp files under /tmp, causing the final renamed file to retain an incompatible SELinux label.

• Atomic writes
  • Create renameio temp files in the destination directory instead of the default temp dir.
  • Applies to both buffered writes and streamed installs in pkg/utils/utilio.

renameio.WriteFile(
    filename,
    content,
    perm,
    renameio.WithTempDir(filepath.Dir(filename)),
)

[bcho]

@copilot remove test change, this fix can skip test

[Copilot]

@copilot remove test change, this fix can skip test

Removed the utilio test changes in 3a57e56; the SELinux fix remains in production code only.

[Copilot]

Pull request overview

This PR updates pkg/utils/utilio atomic-write helpers to create renameio temporary files in the destination directory (rather than the system temp directory), preventing SELinux label mismatches on SELinux-enforcing hosts during bootstrap file installation.

Changes:

• Update InstallFileWithLimitedSize to create renameio pending temp files in filepath.Dir(filename).
• Update WriteFile to pass renameio.WithTempDir(filepath.Dir(filename)) to renameio.WriteFile.
• Document the SELinux-label rationale in function comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.