Using the system provided mkdtemp will make the directory only readable by the user running the script

Snippet from discussion:
could we simply fix this by not relying on system generated temporary dirs for this? You are already creating these in a directory you control, how about temp/temp_package_name_millisecondsSinceEpoch for the temporary name? Creating that with the normal Directory.create function? It should be a pretty local change if I remember correctly on how pub has the io library

Since there can potentially be more than one pub instance running (in different directories concurrently, getting the same package) - consider also including a hash of the directory you are invoking pub on in the dir name.