fix: let the container pick the staging directory for a restored volume

A fixed path under /tmp was both a guess about what the image can write to and
a temp-file smell that Bandit flags. The container makes the directory itself
with mktemp -d and removes it afterwards.

tests/deploy/test_docker.py

@@ -130,8 +130,8 @@ class TestVolumes:
         assert args[-2] == "-c"
         assert "tar xf - -C /data" in args[-1]
         command = args[-1]
-        assert "mkdir -p /tmp/" in command, "the image does not run as root, so staging goes under /tmp"
-        assert command.index("tar xf - -C /tmp/") < command.index("find /data -mindepth 1 -delete"), (
+        assert "mktemp -d" in command, "the container picks the staging directory, not a fixed path"
+        assert command.index('tar xf - -C "$stage"') < command.index("find /data -mindepth 1 -delete"), (
             "the incoming tar is unpacked outside the volume first, so a corrupt one leaves it alone"
         )
         assert runner.streams[0][1] is not None, "the tar is fed in on stdin"