test: contain sepwork scratch per-driver tmpdir, fix /tmp+in-repo leak (#8)

The wcc test drivers ran `ww build <bare-/tmp src>` with no -o, so the
compiler's <stem>.sepwork scratch landed beside the source and was never
cleaned: unbounded /tmp growth (2195 stale dirs observed) that fills tmpfs
and fabricates phantom test failures + silent harness aborts, and for
in-repo fixture builds leaked .sepwork into the tracked tree.

Each leaking build now writes its source + output inside a per-invocation
tmpdir, passes -o <tmpdir>/<stem> so the .sepwork lands inside it, and
rm -rf's the tmpdir on every exit path -- including fopen-fail and the
expected-fail reject builds (scratch is mkdir'd before the build can fail).
`ww run` and explicit-`-o`/byte-id helpers are left as-is; the 990/993
byte-id comparison logic is byte-for-byte unchanged.

Two items filed separately (this commit holds the no-Makefile / no-main.c
rail):
- #13: a stale <src>.s byte-id readback (749) silently no-ops since
  separate-compile emits .s to <ostem>.sepwork/__root.s; documented inline.
- #14: build-system Makefile recipes build selfhost/cmd/*/main.ww with no
  -o and leak main.sepwork in-tree (bounded, gitignored; own commit).

One concern -- sepwork leak hygiene -- across 228 drivers; uniform
transform applied per-file and two-round reviewed. make test: all 402
passed, zero net-new /tmp scratch, zero test-driven in-repo .sepwork.

test/wcc/697_samemod_prefer.c

@@ -40,20 +40,28 @@ runwait(const char *cmd)
 static int
 run_pos(const char *driver, const char *fixdir, const char *tag)
 {
+	/* -o into a /tmp tmpdir so the binary AND `<stem>.sepwork/` land
+	 * outside the repo; the cd keeps source-dir-first import search
+	 * resolving `use mod1; use mod2;`. */
+	char td[1024];
+	snprintf(td, sizeof td, "/tmp/smprefer_%d_%s", getpid(), tag);
+	mkdir(td, 0755);
+
+	char rmcmd[1152];
+	snprintf(rmcmd, sizeof rmcmd, "rm -rf %s", td);
+
 	char cmd[2048];
-	/* cd into the fixture dir so the driver's source-dir-first
-	 * import search resolves `use mod1; use mod2;`. */
 	snprintf(cmd, sizeof cmd,
-	    "cd %s && %s build pos.ww >/dev/null 2>&1", fixdir, driver);
+	    "cd %s && %s build -o %s/pos pos.ww >/dev/null 2>&1",
+	    fixdir, driver, td);
 	if (runwait(cmd) != 0) {
 		fprintf(stderr,
 		    "samemod_prefer[%s]: pos.ww build failed — bare-leaf "
 		    "`read` lookup likely cross-bound\n", tag);
+		runwait(rmcmd);
 		return 1;
 	}
-	char bin[2048];
-	snprintf(bin, sizeof bin, "%s/pos", fixdir);
-	unlink(bin);
+	runwait(rmcmd);
 	return 0;
 }