Add random suffix to temp file name to prevent collision

[mgoldsborough]

Context

From QA review of issue-37-cli-add-bundle-update-awareness branch.

Problem

In packages/cli/src/utils/cache.ts, the temp file for downloads uses ${Date.now()}.mcpb. Two concurrent mpak run or mpak update processes starting within the same millisecond would collide on the same temp path.

Suggested Fix

const tempPath = join(homedir(), ".mpak", "tmp", `${Date.now()}-${Math.random().toString(36).slice(2, 8)}.mcpb`);

Severity

Warning — low probability but trivial fix.