lembas -l / --local: everything in the project, nothing written elsewhere

Config, data and state are rooted at <project>/.agent/local/lembas (or
.lembas/), kept out of git; a local directory the repository carries is
refused. The user's logins and connections.yaml are read, never written; the
user's config.yaml is not read. The TUI is started with TMPDIR inside it (the
compiled binary unpacks its native library there) and OpenTUI's cache goes
there too; the agent's commands keep the user's TMPDIR.

An instance serves models, chat, speech and the balance only: the link,
/remote, the service and the hub are off, deletes are not sent, and the server
library, search, fetch, embeddings and personalization are not used.
Self-update and uninstall are refused. hardline_disable is ignored, and tools
treat the local directory as outside the project.

The smoke test runs a whole local session in the compiled binary and checks
that HOME, the XDG directories and TMPDIR gained nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/voice/speech.ts

@@ -1,11 +1,10 @@
 // Speech to text and text to speech, over the providers voice.stt / voice.tts name. `webui` is a
 // LLeMbas instance's own (OpenAI's shapes at <url>/v1, filled in by the loader); a half with a
 // `fallback` uses it when its provider cannot be reached.
-import { mkdtempSync, readFileSync, rmSync } from "node:fs"
-import { tmpdir } from "node:os"
+import { readFileSync, rmSync } from "node:fs"
 import { join } from "node:path"
 import type { Voice } from "../config/schema.ts"
-import { expandHome } from "../config/paths.ts"
+import { expandHome, makeTempDir } from "../config/paths.ts"
 import { runKeyCmd } from "../config/substitute.ts"
 import { joinUrl, request, tlsFor } from "../provider/http.ts"
 
@@ -83,7 +82,7 @@ async function synthesizeWith(t: Tts, text: string, signal?: AbortSignal): Promi
   const provider = t.provider ?? "openai"
   if (provider === "piper-cli") {
     if (!t.model_path) throw new Error("voice.tts.model_path (a piper .onnx voice) is not set")
-    const dir = mkdtempSync(join(tmpdir(), "lembas-piper-"))
+    const dir = makeTempDir("lembas-piper-")
     const out = join(dir, "say.wav")
     try {
       const args = [t.command ?? "piper", "-m", expandHome(t.model_path), "-f", out, ...(t.speed && t.speed !== 1 ? ["--length-scale", String(1 / t.speed)] : [])]