fix(docker): add writable /tmp to the scratch-based image (#1105)

Kosli's temp-dir usage (directory fingerprinting, evidence tarballing)
relies on os.MkdirTemp, which fails when /tmp doesn't exist at all, as
is the case in the scratch base image. Stage an empty dir in the
builder stage and copy it into the final image as a world-writable /tmp.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: sami-alajrami

Dockerfile

@@ -17,9 +17,12 @@ COPY . .
 
 RUN make build
 
+RUN mkdir -p /image-tmp
+
 ### Final Image ###
 FROM scratch
 
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 COPY --from=builder /go/src/kosli/kosli /bin/kosli
+COPY --from=builder --chmod=1777 /image-tmp /tmp
 ENTRYPOINT ["/bin/kosli"]