efficiently validate tmp tarballs, safely

Fixes #6329 by pretty comprehensively cleaning up how the cache deals with local tarballs. Among other things, it makes sure that each tarball being verified is being written to a unique directory, but it also removes an extraneous operation (copying local tarballs – which will only be read – into the run's temporary directory). So: safer and faster, both things I like.