--pin-source stdin prevents PIN visibility in `ps` output. Use tempfile.mkstemp for all temp files (unpredictable names, 0600 perms). Clean up temp files in finally block. Add tests for PIN not in args and mkstemp usage.
