Add a scoped TempDir component

[taras]

Motivation

Executable Markdown tests need isolated filesystem fixtures without JavaScript
setup. A general resource component should create a temporary working directory
for its content and clean it up through structured concurrency.

Dependency

Depends on #203, which establishes that projected content retains the caller's
lexical bindings while its live resources are owned by the component invocation.
<TempDir> relies on the ordinary component lifecycle from that story. It must
not construct private eval-scope ownership or add a name-specific branch to the
expansion algorithm.

Core component registration and override policy are tracked separately by #202.
This story may use the smallest private mechanism needed to make <TempDir>
automatically available from core.

Authoring contract

<TempDir>
 <Content />
</TempDir>

• <TempDir> is available in regular and testing documents.
• It creates a unique temporary directory before expanding its content.
• It applies that directory as contextual Env.cwd for everything expanded
  inside it.
• Nested components such as <File>, <Glob>, agents, and processes inherit
  that working directory without receiving a path prop.
• It renders its content normally.
• When its content finishes, fails, or is cancelled, it restores the previous
  Env.cwd and removes the temporary directory.
• Nested and sibling <TempDir> instances remain isolated.

Cleanup

Cleanup is unconditional in the initial contract. There is no retain prop and
no automatic retention after failure. A future execution-level inspection
policy may retain scoped resources without changing individual component APIs.

Cleanup participates in structured shutdown and must finish before the
component scope exits. Resources created by projected content stop first under
the component-lifecycle contract established by #203. Cleanup must not use
fire-and-forget filesystem operations.

Testing

Add a colocated TempDir.test.md that verifies the component expands and
renders its child content under xmd test. The first story does not use
JavaScript in the Markdown test.

Add lower-level automated tests that verify:

• Env.cwd is the created directory while content expands;
• the previous Env.cwd is restored afterward;
• sibling and nested temporary directories are distinct;
• the directory is removed after success;
• the directory is removed after a child error;
• the directory is removed after cancellation or halt; and
• a resource created by projected content stops before the directory is removed,
  relying on the generic lifecycle from Bind projected content resources to the component invocation scope #203 rather than TempDir-specific scope
  management.

The following <File> story adds a Markdown integration test that writes and
reads a relative file inside <TempDir>, proving that filesystem components
inherit its contextual working directory without JavaScript.

Documentation

• Specify <TempDir> in the Executable Markdown component reference.
• Add a website example showing isolated filesystem setup.
• Describe automatic cleanup and the absence of per-component retention.

Acceptance criteria

• Bind projected content resources to the component invocation scope #203 is complete before this story is implemented.
• <TempDir> is a core-owned ordinary component, not a special expansion
  directive.
• A regular document can render content inside <TempDir>.
• All descendants observe the temporary directory through Env.cwd.
• Previous working-directory context is restored after the component exits.
• Projected resources finish before temporary-directory cleanup through the
  shared component lifecycle.
• Cleanup completes on success, error, and cancellation.
• Nested and sibling instances do not share directories.
• The colocated Markdown smoke test passes through xmd test.
• Runtime lifecycle tests pass on Deno, Node, and Bun where the package test
  matrix applies.
• Specification and website documentation ship in the same PR.

Not included

• A retain prop or retain-on-failure behavior.
• Exposing the generated path as a component prop. The self-closing form
  renders its canonical path and as captures it through the generic capture
  mechanism, so a document can pass the path onward itself.
• Restricting the component to testing mode.
• <File> or <Glob> behavior.
• A public core component registry or general override policy (Register function components and migrate legacy component handlers #202).