scripts/diffcheck.sh: Use secure temp files and git archive for better safety

[maradini77]

Summary

Refactor scripts/diffcheck.sh to improve security and reliability by replacing fixed /tmp paths with secure temporary directories and avoiding destructive git checkout.

Changes

• Secure temp files: Use mktemp -d with automatic cleanup via trap instead of hardcoded /tmp paths
• Non-destructive git operations: Replace git checkout HEAD^ with git archive to avoid modifying working tree state

[kallewoof]

I didn't really write that code. The reason I'm on blame is because of the move that happened in #1432.

That said, this PR seems to unnecessarily complicate things. This script is meant to be run in Github Actions. It's not meant to be run by users, and doesn't need "better safety". I have no strong opinion on the subject though so if others think this is useful, go ahead.

[jonatack]

Thank you for the feedback @kallewoof.