Follow-up: handle macOS /var/folders linked-path guard in tests

[vibeforge1111]

Context

During the r17 installer upgrade-refresh verification on macOS, test runs needed TMPDIR outside macOS /var/folders because Apple exposes /var as a link to /private/var. The linked-path guard can treat that normal platform shape as unsafe even when the test workspace is disposable.

This is not blocking the r17 installer UX fix. r17 preserves the secure secret-backend gate and only pauses non-interactive upgrade refreshes under the narrow existing-install conditions.

Desired follow-up

Either:

• document the macOS test requirement to set TMPDIR outside /var/folders, or
• teach the guard to canonicalize Apple /var -> /private/var safely without weakening protection against malicious/out-of-root symlink writes.

Acceptance criteria

• macOS tests can run with the default temp directory without a false positive, or the TMPDIR requirement is explicit in the test docs.
• Malicious symlink/path escape cases remain blocked.
• The installer secure-backend setup gate remains unchanged for first-time setup and explicit secret updates.