Use private temporary files in the vector journey flow

[coderabbitai]

Summary

Replace predictable temporary configuration and log paths in ci/journey.sh with private files created by mktemp.

Rationale

The vector journey flow writes storage credentials to /tmp/journey-chunks.yaml for some backends. Predictable paths can permit local-file disclosure, replacement, or symlink attacks before the archiver or compactor consumes the files.

Affected area

• ci/journey.sh
• story_vector
• story_vector_compaction

Required changes

• Create the generated configuration and related log files with mktemp.
• Store the generated paths in local variables.
• Pass the generated configuration path to the archiver and to story_vector_compaction.
• Remove the generated files on every story_vector exit path, including failures.

Acceptance criteria

• No predictable /tmp/journey-chunks.yaml or /tmp/journey-chunks.log path remains in the vector journey flow.
• The generated files have owner-only permissions.
• The vector journey flow still passes its configuration path to all required archiver and compactor calls.
• Cleanup occurs after successful and failed execution paths.

Backlinks

• Deferred from PR Tier pgvector columns to Iceberg and narrow vector searches to their nearest clusters #77: Tier pgvector columns to Iceberg and narrow vector searches to their nearest clusters #77
• Review comment: Tier pgvector columns to Iceberg and narrow vector searches to their nearest clusters #77 (comment)

Requested by @vyruss.