build(Makefile): use atomic writes for remaining gen targets (#22670)

Follow-up to #22612. Running `git status --short` in a loop during `make
-B -j gen` still showed intermediate states for several files. This PR
fixes the remaining ones.

The main issues:

- `generate.sh` ran `gofmt` and `goimports` in-place after moving files
  into the source tree. Now it formats in a workdir first and only `mv`s 
  the final result.
- `protoc` targets wrote directly to the source tree. Wrapped with
  `scripts/atomic_protoc.sh` which redirects output to a tmpdir.
- Several generators used hardcoded `/tmp/` paths. On systems where
  `/tmp` is tmpfs, `mv` degrades to copy+delete. Switched to a
  project-local `_gen/` directory (gitignored, same filesystem).
- `apidoc/.gen` and `cli/index.md` used `cp` for final output. Replaced
  with `mv`.
- `manifest.json` was written twice (unformatted, then formatted). Now
  `.gen` writes to a staging file and the manifest target does one
  formatted atomic write.
- `biome_format.sh` silently skipped files in gitignored dirs. Added
  `--vcs-enabled=false`.

Two helpers reduce the Makefile boilerplate: `scripts/atomic_protoc.sh`
(wraps protoc) and an `atomic_write` Make define
(stdout-to-temp-to-target pattern). `.PRECIOUS` now also covers `.pb.go`
and mock files.

Verification: `make -B -j gen` x3 with `git status` polling, no changes.

Refs #22612

coderd/database/generate.sh

@@ -22,8 +22,12 @@ SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
 	# The logic below depends on the exact version being correct :(
 	sqlc generate
 
-	tmpfile=$(mktemp "${TMPDIR:-/tmp}/queries.sql.go.XXXXXX")
-	trap 'rm -f "$tmpfile"' EXIT
+	# Work directory for formatting before atomic replacement of
+	# generated files, ensuring the source tree is never left in a
+	# partially written state.
+	mkdir -p ../../_gen
+	workdir=$(mktemp -d ../../_gen/.dbgen.XXXXXX)
+	trap 'rm -rf "$workdir"' EXIT
 
 	first=true
 	files=$(find ./queries/ -type f -name "*.sql.go" | LC_ALL=C sort)
@@ -38,32 +42,34 @@ SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
 
 		# Copy the header from the first file only, ignoring the source comment.
 		if $first; then
-			head -n 6 <"$fi" | grep -v "source" >"$tmpfile"
+			head -n 6 <"$fi" | grep -v "source" >"$workdir/queries.sql.go"
 			first=false
 		fi
 
 		# Append the file past the imports section into queries.sql.go.
-		tail -n "+$cut" <"$fi" >>"$tmpfile"
+		tail -n "+$cut" <"$fi" >>"$workdir/queries.sql.go"
 	done
 
-	# Atomically replace the target file.
-	mv "$tmpfile" queries.sql.go
-
-	# Move the files we want.
-	mv queries/querier.go .
-	mv queries/models.go .
+	# Move sqlc outputs into workdir for formatting.
+	mv queries/querier.go "$workdir/querier.go"
+	mv queries/models.go "$workdir/models.go"
 
 	# Remove temporary go files.
 	rm -f queries/*.go
 
-	# Fix struct/interface names.
-	gofmt -w -r 'Querier -> sqlcQuerier' -- *.go
-	gofmt -w -r 'Queries -> sqlQuerier' -- *.go
+	# Fix struct/interface names in the workdir (not the source tree).
+	gofmt -w -r 'Querier -> sqlcQuerier' -- "$workdir"/*.go
+	gofmt -w -r 'Queries -> sqlQuerier' -- "$workdir"/*.go
 
-	# Ensure correct imports exist. Modules must all be downloaded so we get correct
-	# suggestions.
+	# Ensure correct imports exist. Modules must all be downloaded so we
+	# get correct suggestions.
 	go mod download
-	go tool golang.org/x/tools/cmd/goimports -w queries.sql.go
+	go tool golang.org/x/tools/cmd/goimports -w "$workdir/queries.sql.go"
+
+	# Atomically replace all three target files.
+	mv "$workdir/queries.sql.go" queries.sql.go
+	mv "$workdir/querier.go" querier.go
+	mv "$workdir/models.go" models.go
 
 	go run ../../scripts/dbgen
 	# This will error if a view is broken. This is in it's own package to avoid