Doctor probe 3 and probe 5 redirect to /tmp, falsely failing in read-only sandbox #1775

What's broken

probe-3-container-gateway.sh and probe-5-signing-key.sh redirect command output to ${TMPDIR:-/tmp}/.... Because /tmp is mounted read-only inside the doctor's execution sandbox, the file redirection fails with exit code 1 (Read-only file system), causing the probes to abort early and report false failures even when the signing key is readable or container runtimes are functional.

Which layer

• plugins/magpie-setup/skills/isolated-setup-doctor/scripts/probe-3-container-gateway.sh
• plugins/magpie-setup/skills/isolated-setup-doctor/scripts/probe-5-signing-key.sh

How to reproduce

Run the doctor probe scripts inside a sandboxed environment where /tmp is read-only:

1. For probe-5-signing-key.sh:
   Line 28 executes:

   head -c 1 "$key" >/dev/null 2>"${TMPDIR:-/tmp}/signing-key.err"

   When ${TMPDIR:-/tmp} is read-only, the redirection fails with bash: /tmp/signing-key.err: Read-only file system (exit status 1), and the probe reports a false failure (PROBE: signing-key → ✗ ...).

2. For probe-3-container-gateway.sh:
   Line 103 executes:

   _probe_timeout 15 "$rt" info > /dev/null 2>"${TMPDIR:-/tmp}/$rt-probe.err"

   The redirection fails with exit code 1 on read-only /tmp, reporting false failure even when the container daemon is reachable.

Expected vs actual

• Expected: Probes hold command output in memory variables and write no files under /tmp.
  As documented in plugins/magpie-setup/skills/isolated-setup-doctor/scripts/README.md:

  "Hold a command's output in a variable, not a file: /tmp is read-only inside the sandbox, and a failed redirection skips the command and exits 1, which a probe reading exit codes takes for the command's own answer. Probe 1 once passed every agent that way. Add a test under ../tests/ that runs the script against a fake binary."

• Actual: While Probe 1 was fixed in PR fix(setup): stop doctor probe 1 passing an agent it never asked #1770, Probe 3 and Probe 5 still redirect output to files under /tmp.

Surface area (optional)

• plugins/magpie-setup/skills/isolated-setup-doctor/scripts/probe-3-container-gateway.sh
• plugins/magpie-setup/skills/isolated-setup-doctor/scripts/probe-5-signing-key.sh
• plugins/magpie-setup/skills/isolated-setup-doctor/tests/