fix(launcher): give Chromium a usable temp directory

Chromium on macOS takes its temp directory from NSTemporaryDirectory(), which is
unusable under Darling. Electron opens files in app.asar asynchronously by
copying them to a temp file, and reports the failed copy as "not found", so the
Riot client showed a "Not Found" page instead of its UI. Running the client
binary as Node reproduces it: fs.readFileSync on app.asar/dist/renderer/index.html
works, fs.createReadStream fails with ENOENT, and MAC_CHROMIUM_TMPDIR fixes it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/TROUBLESHOOTING.md

@@ -161,6 +161,12 @@ LaunchServices dereferenced a nullable error-output pointer in six paths. The pa
 
 LaunchServices now opens `http`, `https` and `mailto` links on the Linux desktop itself. It loads the host's `libsystemd.so.0` and asks `xdg-desktop-portal` (`org.freedesktop.portal.OpenURI`) on the user session bus to open the link, so your default browser starts outside Darling and survives `darling shutdown`. Without a portal, it starts `xdg-open` in a transient systemd user unit instead. It also reports a handler for these schemes, since Electron checks for one before opening a link. Other schemes, control characters and URLs over 4096 bytes are rejected. If a link still does nothing, check the client's stderr for a `LaunchServices:` line and that `busctl --user status org.freedesktop.portal.Desktop` works on the host. Both LaunchServices and AppKit must be rebuilt. The hand-off passed the host-side D-Bus regression and opened the host browser from a guest through both `open(1)` and `NSWorkspace`; a link clicked in the Riot client is not yet confirmed. The null-pointer fix does not explain every unrelated button crash.
 
+## Riot client shows "Not Found" instead of its UI
+
+The client window opens but only shows `Not Found`, and its log has `ENOENT, dist/renderer/index.html not found in …/app.asar` although the archive contains that file. Electron cannot hand out a descriptor into `app.asar`, so its asynchronous `fs.open` copies the file to a temporary file first (`copyFileOut`) and reports a failed copy as "not found". Chromium on macOS takes its temporary directory from `NSTemporaryDirectory()`, not `TMPDIR`, and that directory is unusable here, so every copy fails. Synchronous reads such as `fs.readFileSync` do not copy and keep working, which is why the rest of the client starts.
+
+The launcher sets `MAC_CHROMIUM_TMPDIR=/private/tmp`, which Chromium checks first; `scripts/install-runtime.sh` already creates that guest directory with mode `1777`. To check the archive outside the client, run the client binary as Node (`ELECTRON_RUN_AS_NODE=1`) with a script that calls `fs.createReadStream` on a file inside `app.asar`: it fails without the variable and reads the file with it.
+
 ## Language dropdown closes Riot, or client resize leaves a clipped UI
 
 The [report in issue #1](https://github.com/lucannez64/darling-lol/issues/1#issuecomment-6194498757) contains an Electron renderer abort with `Symbol not found: _CTFontDescriptorCreateMatchingFontDescriptors`. CoreText now exports font-descriptor matching and localized-attribute lookup, and enumerates installed font families through fontconfig instead of returning a null stub. Localized lookup currently falls back to canonical font names. The standalone font-list check exercises Chromium's sequence, including mandatory family matching and retained results.