Complete assembled validation and migrate remaining tests

internal/core/diagnostics/output_session.go

@@ -51,6 +51,7 @@ type OutputSession struct {
 	replace     func(string, []byte) error
 	temp        *os.File
 	tempPath    string
+	tempDir     string
 	publishPath string
 	direct      bool
 	stdout      io.Writer
@@ -159,11 +160,16 @@ func (s *OutputSession) Prepare() error {
 	if err != nil {
 		return err
 	}
-	s.temp, err = os.CreateTemp(filepath.Dir(s.publishPath), ".audita-output-*")
+	s.tempDir, err = os.MkdirTemp(filepath.Dir(s.publishPath), ".audita-output-*")
 	if err != nil {
 		return fmt.Errorf("prepare transcript output %q: %w", s.transcript, err)
 	}
-	s.tempPath = s.temp.Name()
+	s.tempPath = filepath.Join(s.tempDir, "payload")
+	s.temp, err = os.OpenFile(s.tempPath, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0644)
+	if err != nil {
+		_ = s.Close()
+		return fmt.Errorf("prepare transcript output %q: %w", s.transcript, err)
+	}
 	if info != nil {
 		if err := s.temp.Chmod(info.Mode().Perm()); err != nil {
 			_ = s.Close()
@@ -189,6 +195,12 @@ func (s *OutputSession) Close() error {
 		}
 		s.tempPath = ""
 	}
+	if s.tempDir != "" {
+		if err := os.Remove(s.tempDir); err != nil && !errors.Is(err, os.ErrNotExist) {
+			errs = append(errs, err)
+		}
+		s.tempDir = ""
+	}
 	return errors.Join(errs...)
 }