Add managed per-fixture scratch directories

[helly25]

Summary:

• add test_tmpdir with an optional basename prefix for unique fixture directories below BASHTEST_TMPDIR
• add --keep-tmpdir=never|failure|always while preserving the existing failure-retention default
• print retained scratch paths and document Bazel sandbox limitations
• test uniqueness, containment, and path rejection

Tests:

• bazel test //...
• pre-commit run on all changed files