Keep the test suite's temp files inside the test directory

[ekamran]

Fixes #77

The runner never sets WP_TEMP_DIR, so the WordPress test suite writes its temporary files into the shared system temp directory through get_temp_dir(). Several tests use fixed file names there, and tests/phpunit/tests/image/functions.php glob-deletes wordpress-gsoc-flyer*.* in setUp(), so two runs sharing that directory can delete or overwrite each other's files mid test, and files left by one user can break the next user on permissions.

This is what #77 reported in 2018, and danielbachhuber suggested the WP_TEMP_DIR route in the same thread. The exact file names from the 2018 report have changed in today's suite, but fixed-name writers and the shared directory are still there, and Core's get_temp_dir() still checks WP_TEMP_DIR first.

This makes prepare.php append a small block to the generated wp-tests-config.php: it defines WP_TEMP_DIR as a wp-temp directory next to the config file, creates it on load, and fails with a clear message if the directory cannot be created or is not writable, instead of silently falling back to the shared system temp. The path is anchored to the config file's own location, so it stays correct after the config is copied to a remote test environment over SSH, and the directory is removed together with the test directory during cleanup. No new environment variable is needed.

Concurrent runs are isolated when each run uses its own WPT_TEST_DIR, which the README's concurrency section already recommends. The README now notes that the suite's temp files live inside that directory.

Verification:

• A generated config built from the real wp-tests-config-sample.php passes php -l, and including it standalone defines the constant and creates wp-temp next to the config file.
• Through Core's own test bootstrap, get_temp_dir() returns the wp-temp path and wp_tempnam() lands inside it.
• Tests_Image_Functions runs green with the redirected temp directory: 100 tests, 4 skipped.
• The failure path was exercised with a read-only parent: PHP's own mkdir() warning is followed by the clear message and exit code 1. The native warning is kept on purpose, because it carries the exact permission context and WPCS discourages error silencing.
• php -l and PHPCS pass on the touched files.

This is independent of #336 and #337 and complements them: force removal, database cleanup, and temp file isolation are three separate cleanup gaps.

Use of AI

AI assistance: Yes
Tool(s): Claude Code and Codex
Used for: Investigation, implementation review, edge-case testing, and PR wording. I reviewed the reasoning and test results, and I take responsibility for the contribution.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @dankingtech.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Unlinked contributors: dankingtech.

Co-authored-by: ekamran <ekamran@git.wordpress.org>
Co-authored-by: danielbachhuber <danielbachhuber@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.