build(Makefile): use atomic writes for remaining gen targets (#22670)

Follow-up to #22612. Running `git status --short` in a loop during `make
-B -j gen` still showed intermediate states for several files. This PR
fixes the remaining ones.

The main issues:

- `generate.sh` ran `gofmt` and `goimports` in-place after moving files
  into the source tree. Now it formats in a workdir first and only `mv`s 
  the final result.
- `protoc` targets wrote directly to the source tree. Wrapped with
  `scripts/atomic_protoc.sh` which redirects output to a tmpdir.
- Several generators used hardcoded `/tmp/` paths. On systems where
  `/tmp` is tmpfs, `mv` degrades to copy+delete. Switched to a
  project-local `_gen/` directory (gitignored, same filesystem).
- `apidoc/.gen` and `cli/index.md` used `cp` for final output. Replaced
  with `mv`.
- `manifest.json` was written twice (unformatted, then formatted). Now
  `.gen` writes to a staging file and the manifest target does one
  formatted atomic write.
- `biome_format.sh` silently skipped files in gitignored dirs. Added
  `--vcs-enabled=false`.

Two helpers reduce the Makefile boilerplate: `scripts/atomic_protoc.sh`
(wraps protoc) and an `atomic_write` Make define
(stdout-to-temp-to-target pattern). `.PRECIOUS` now also covers `.pb.go`
and mock files.

Verification: `make -B -j gen` x3 with `git status` polling, no changes.

Refs #22612

scripts/atomic_protoc.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Runs protoc into a temporary directory, then atomically moves each
+# generated file to the source tree. This prevents interrupted builds
+# from leaving truncated or deleted .pb.go files.
+#
+# Usage: atomic_protoc.sh [protoc flags...] ./path/to/file.proto
+
+set -euo pipefail
+
+mkdir -p _gen
+tmpdir=$(mktemp -d -p _gen)
+trap 'rm -rf "$tmpdir"' EXIT
+
+# Rewrite --go_out=. and --go-drpc_out=. to point at tmpdir.
+args=()
+for arg in "$@"; do
+	case "$arg" in
+	--go_out=.) args+=("--go_out=$tmpdir") ;;
+	--go-drpc_out=.) args+=("--go-drpc_out=$tmpdir") ;;
+	*) args+=("$arg") ;;
+	esac
+done
+
+protoc "${args[@]}"
+
+# Move all generated .go files from tmpdir back to the source tree.
+find "$tmpdir" -name '*.go' -print0 | while IFS= read -r -d '' f; do
+	dest="${f#"$tmpdir"/}"
+	mv "$f" "$dest"
+done

scripts/biome_format.sh

@@ -16,7 +16,7 @@ trap 'rm -f "$output_file"' EXIT
 
 if (
 	cd "$repo_root/site"
-	pnpm exec biome format --write "$target"
+	pnpm exec biome format --write --vcs-enabled=false "$target"
 ) >"$output_file" 2>&1; then
 	cat "$output_file"
 	exit 0