Nix promises to run us in an (empty) temporary directory. So we should
not need mktemp, we can just use deterministic names.
Our temporary directory should already not be leaking into the
output (and we enforce that for the profile), so this should just be
cleanup that makes debugging slightly easier.