fix: untrack binary, Docker chmod, os.tmpdir (#779, #709, #708)

[itstimwhite]

Summary

Three mechanical fixes from the open issue tracker:

• Untrack bin/gstack-global-discover (bin/gstack-global-discover is a tracked generated binary — bloats clone size and causes perpetual dirty working tree #779): 58MB Mach-O arm64 binary was tracked despite .gitignore entry. git rm --cached removes it from the index. The .ts source remains tracked, ./setup compiles it locally. Note: existing clones retain the binary in git history until a future history rewrite.

• Docker chmod -R 1777 /tmp sticky bit (Docker: chmod -R 1777 /tmp sets sticky bit on files #709): The -R flag in .github/docker/Dockerfile.ci applied the sticky bit to files inside /tmp, which is meaningless (sticky bit only matters on directories). Replaced with find /tmp -type d -exec chmod 1777 {} +.

• Hardcoded /tmp in cookie-import (Cross-platform: hardcoded /tmp in cookie-import-browser.ts #708): browse/src/cookie-import-browser.ts used a hardcoded /tmp path instead of os.tmpdir(). On macOS, os.tmpdir() returns a per-user temp directory (/var/folders/...), which is actually a security improvement (mode 700 vs world-writable).

Pre-Landing Review

No issues found.

Test plan

• bun test passes (all tiers)
• git ls-files bin/gstack-global-discover returns empty
• grep -r 'B=~/' *.md unaffected (tilde fix deferred, see below)

Notes

• Use $HOME instead of ~ in SKILL.md browse binary assignment #785 (tilde → $HOME) intentionally deferred. Open PR feat: declarative multi-host platform + OpenCode, Slate, Cursor, OpenClaw (v0.15.5.0) #793 refactors scripts/resolvers/types.ts into a declarative host config system. Our tilde fix would target lines that feat: declarative multi-host platform + OpenCode, Slate, Cursor, OpenClaw (v0.15.5.0) #793 deletes. Revisit after feat: declarative multi-host platform + OpenCode, Slate, Cursor, OpenClaw (v0.15.5.0) #793 lands.
• Drive-by observation: openDbFromCopy() error path (line 410) only cleans up tmpPath but not WAL/SHM files on failure. Pre-existing, not introduced by this change.

🤖 Generated with Claude Code

[garrytan]

Closing — Docker chmod and os.tmpdir overlap with open PRs #747 and #748. The binary untracking from #779 was already resolved (binaries are no longer tracked). Thank you @itstimwhite!