fix: replace ~version.json with .tmp/version.json for shell portability

[hoegertn]

This pull request was created by @kiro-agent on behalf of @hoegertn 👻

Comment with /kiro fix to address specific feedback or /kiro all to address everything.
_{Learn about Kiro Web}

---

Problem

The compute-version CLI wrote the version artifact to a file literally named ~version.json. A leading unquoted ~ is a tilde-prefix in shell grammar — while /bin/sh and bash tolerate it by falling back to the literal string, JS-based shell emulators (Yarn Berry's @yarnpkg/shell, pnpm's shell-emulator, Bun's built-in shell) reject ~name outright and abort the build:

👾 Unsupported tilde expansion.
  ~version.json
  ~
Failed

Solution

New default path: .tmp/version.json

• Single .gitignore/.npmignore entry covers the temp directory
• No shell-parsing hazard — leading . is inert in every shell
• No collision with other files
• Parent directory created automatically by the CLI

Configurable output path

• --output <path> / -o <path> CLI flag
• VERSION_OUTPUT_PATH environment variable
• Path validation rejects filenames starting with ~, -, or # (all shell-hazardous)

Shell-safe path rendering

A shellSafePath() helper ensures all relative paths emitted in command strings use an explicit ./ prefix (e.g., cat ./.tmp/version.json), preventing any ambiguity for shell parsers.

Backwards compatibility (deprecation window)

readVersionFile() checks the new path first, then falls back to reading ~version.json with a deprecation warning. This fallback will be removed in the next minor release. The CLI no longer writes to ~version.json.

Migration

If you have CI scripts or projen tasks that reference ~version.json:

1. Replace ~version.json with .tmp/version.json (or cat ./.tmp/version.json)
2. The readVersionFile() API handles the fallback automatically during the transition

Changes

• src/versioning/output-path.ts — new module with DEFAULT_VERSION_OUTPUT_PATH, validateOutputPath(), shellSafePath()
• src/versioning/compute-version.ts — refactored to use new path, added --output flag, readVersionFile() with fallback
• .projenrc.ts — added .tmp/ to gitignore and npmignore
• test/versioning/output-path.test.ts — 15 tests for path validation and shell-safety
• test/versioning/compute-version.test.ts — 9 tests for readVersionFile and validation
• README.md, docs/VERSIONING.md — updated CLI documentation

Verification

npx projen build passes: jsii compile, 168 tests (10 suites), ESLint, jsii-pacmak all green.