fix: stabilize ./... tests and add bounded mirror reload timeout

[Vonng]

Summary

• fix issue Can the pig command download offline packages? #7 by preventing root go test ./... from entering ad-hoc tmp/ programs
• fix issue pig clashes with apache pig #9 by simplifying PutFile temp-file fallback and removing redundant temp file handle creation
• optimize Makefile release/dev aliases and repair broken target wiring (gr-check, release-new)
• align reload timeout behavior with existing timeout-based flows by introducing FetchFirstValidWithTimeout and using it in ext reload / repo reload

Details

• .gitignore: keep tmp/ ignored except tracked tmp/go.mod
• tmp/go.mod: split ad-hoc scripts into nested module so package discovery for root module excludes tmp
• internal/utils/utils.go: remove redundant os.Create in PutFile, use direct temp path write + sudo move
• internal/utils/mirror.go: add DefaultMirrorFetchTimeout + FetchFirstValidWithTimeout
• cli/ext/reload.go, cli/repo/reload.go: switch mirror fetch to timeout wrapper
• internal/utils/mirror_test.go: add deadline test coverage
• Makefile: remove conflicting aliases and fix target references

Validation

• go test ./...
• go vet ./...
• go test -race ./internal/utils ./cli/ext ./cli/repo ./cmd
• make -n r
• make -n rel
• make -n b
• make -n release-new
• make -n gr-check