Secure genesis miner temporary files

[NateIsern]

Motivation

• The setup script genesis-mine.sh previously wrote and sourced predictable files under /tmp which allowed local race/pre-creation attacks to inject shell code.
• The script also runs sudo to install packages before sourcing the results file, increasing impact if an attacker can cause code execution by priming sudo credentials.

Description

• Replace predictable /tmp artifacts with a private temporary directory created by mktemp -d assigned to GENESIS_TMPDIR and restricted with chmod 700 so only the script owner can access generated files.
• Store the helper path as GENESIS_MINER and the results path as GENESIS_RESULTS, write the Python miner into GENESIS_MINER, and update it to write results to GENESIS_RESULTS via os.environ.
• Invoke the Python helper with python3 "$GENESIS_MINER" and source only the private "$GENESIS_RESULTS" file, and add an EXIT trap cleanup_genesis_tmp() to remove the temporary directory on exit.

Testing

• Ran bash -n genesis-mine.sh to validate shell syntax and it succeeded.
• Ran git diff --check to verify no leftover whitespace or conflict markers and it succeeded.
• Attempted shellcheck genesis-mine.sh but shellcheck is not installed in the environment so it was not executed.

---

Codex Task