Keep flocks and staging files out of shared /tmp

[Chessing234]

Summary

• Keep the 1Password lock flock out of world-writable /tmp.
• Keep the theme-set flock out of world-writable /tmp.
• Keep monitor-watch flock files out of world-writable /tmp.
• Stage menu IPC files out of world-writable /tmp.
• Stage the dev-link sudoers draft out of world-writable /tmp.

Combines #10503, #10504, #10505, #10506, and #10507 into one reviewable PR; those will be closed.

Test plan

• Cherry-picks apply cleanly on origin/quattro
• bash test/shell.d/theme-set-lock-test.sh
• bash test/shell.d/menu-ipc-path-test.sh
• Exercise 1Password lock, monitor-watch, and dev-link sudoers staging paths

[Chessing234]

folding into #12109 with the other /tmp path hardening