GeoIP: extract beside the cache so the move never crosses filesystems

[JWriter20]

downloadMmdb extracted the GeoIP archive into os.tmpdir() and then renameSync'd the database into ~/.cache/camoufox/geoip/mmdb/. When /tmp is a separate filesystem (tmpfs, a container mount), that rename fails:

EXDEV: cross-device link not permitted, rename '/tmp/camoufox-geoip-…/geoip-aio-all.mmdb' -> '~/.cache/camoufox/geoip/mmdb/…-combined.mmdb'

and every launch that resolves GeoIP fails before the browser starts. The temporary directory is now created inside the cache directory, so the move is a same-filesystem rename. The Python launcher uses shutil.move, which already handles this.

Regression test in tests/geoip-config.test.ts fails before (extract went to /tmp) and passes after; full TS suite 821 passed, biome and tsc clean.

🤖 Generated with Claude Code

[github-actions]

✅ Tests passed

Camoufox 156.0.1 (beta.32), built on Firefox 156, tested against Playwright v1.62.0 — the newest released suite not ahead of Firefox 156 (it targets Firefox 153.0).

Suite	Result	Detail
native_rules	✅ pass	28 passed, 0 failed, 28 collected
pythonlib	✅ pass	652 passed, 0 failed, 654 collected
typescript	✅ pass	825 passed, 0 failed, 844 collected
build	✅ pass	built camoufox-bin (0.7 MB)
patch_guards_spoofing	✅ pass	8 passed, 0 failed, 8 collected
patch_guards_automation	✅ pass	16 passed, 0 failed, 16 collected
patch_guards_parity	✅ pass	8 passed, 0 failed, 8 collected
skiplist_audit	✅ pass	17 passed, 0 failed, 17 collected
native_browser	✅ pass	46 passed, 0 failed, 46 collected
build_tester	✅ pass	478 passed, 4 failed, 482 collected
playwright	✅ pass	2248 passed, 0 failed, 2315 collected (across 6 shards), 328 via main-world fallback
typescript_browser	✅ pass	16 passed, 0 failed, 19 collected
native_growth	✅ pass	7 passed, 0 failed, 7 collected (across 7 shards)
sundial	✅ pass	grade A+ — 625/630 in-scope checks passed

_{The Playwright suite is upstream playwright-python at the tag above, fetched fresh, with tests/camoufox/ overlaid. It runs with world isolation on — the configuration Camoufox ships — and only the failures are re-run with it off; those count as passes and are reported above as main-world fallbacks, which is the size of the isolated-world gap. Tests Camoufox cannot pass by design are deselected via ci/skiplist.yml — each with a stated reason. The stealth check reports a grade only; its per-vector detail is deliberately never published.}