fix: fail closed thothctl secret sources

tools/thothctl/internal/output/sanitize_test.go

@@ -19,7 +19,7 @@ func TestSanitizeRedactsPasswordTokenAndKeyFields(t *testing.T) {
 func TestSanitizeRedactsSecretFileContents(t *testing.T) {
 	t.Parallel()
 
-	secretFile := filepath.Join(t.TempDir(), "provider-token")
+	secretFile := filepath.Join(physicalTempDir(t), "provider-token")
 	if err := os.WriteFile(secretFile, []byte("top-secret-value\n"), 0o600); err != nil {
 		t.Fatal(err)
 	}
@@ -37,7 +37,7 @@ func TestSanitizeRedactsSecretFileContents(t *testing.T) {
 func TestSecretValuesFromFilesRejectsOversizedFiles(t *testing.T) {
 	t.Parallel()
 
-	secretFile := filepath.Join(t.TempDir(), "oversized-token")
+	secretFile := filepath.Join(physicalTempDir(t), "oversized-token")
 	if err := os.WriteFile(secretFile, make([]byte, 64*1024+1), 0o600); err != nil {
 		t.Fatal(err)
 	}
@@ -46,3 +46,17 @@ func TestSecretValuesFromFilesRejectsOversizedFiles(t *testing.T) {
 		t.Fatal("SecretValuesFromFiles() error = nil, want oversized-file error")
 	}
 }
+
+func physicalTempDir(t *testing.T) string {
+	t.Helper()
+	root, err := filepath.EvalSymlinks(os.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	directory, err := os.MkdirTemp(root, "thothctl-output-test-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = os.RemoveAll(directory) })
+	return directory
+}