Use the root-private publication filesystem for Git askpass

tools/publish_gitea.py

@@ -126,7 +126,7 @@ def publish(args):
             "Bundle must be a root-owned reviewed regular file without shared write access")
     root_directory(args.bundle.parent)
     os.umask(0o077)
-    with tempfile.TemporaryDirectory(prefix="fb-gitea-push-", dir="/run") as tmp:
+    with tempfile.TemporaryDirectory(prefix="fb-gitea-push-", dir=args.bundle.parent) as tmp:
         directory = Path(tmp)
         source = directory / "source.git"
         before = check_bundle(args, source)