build(Makefile): use atomic writes for remaining gen targets (#22670)

Follow-up to #22612. Running `git status --short` in a loop during `make
-B -j gen` still showed intermediate states for several files. This PR
fixes the remaining ones.

The main issues:

- `generate.sh` ran `gofmt` and `goimports` in-place after moving files
  into the source tree. Now it formats in a workdir first and only `mv`s 
  the final result.
- `protoc` targets wrote directly to the source tree. Wrapped with
  `scripts/atomic_protoc.sh` which redirects output to a tmpdir.
- Several generators used hardcoded `/tmp/` paths. On systems where
  `/tmp` is tmpfs, `mv` degrades to copy+delete. Switched to a
  project-local `_gen/` directory (gitignored, same filesystem).
- `apidoc/.gen` and `cli/index.md` used `cp` for final output. Replaced
  with `mv`.
- `manifest.json` was written twice (unformatted, then formatted). Now
  `.gen` writes to a staging file and the manifest target does one
  formatted atomic write.
- `biome_format.sh` silently skipped files in gitignored dirs. Added
  `--vcs-enabled=false`.

Two helpers reduce the Makefile boilerplate: `scripts/atomic_protoc.sh`
(wraps protoc) and an `atomic_write` Make define
(stdout-to-temp-to-target pattern). `.PRECIOUS` now also covers `.pb.go`
and mock files.

Verification: `make -B -j gen` x3 with `git status` polling, no changes.

Refs #22612

.gitignore

@@ -38,6 +38,7 @@ site/.swc
 
 # Make target for updating generated/golden files (any dir).
 .gen
+/_gen/
 .gen-golden
 
 # Build