Set TMPDIR for the renderer

 * While investigating a crash we noticed that dvipdfmx was calling
   `mktemp` and leaving behind files /tmp, which aren't being gc'd.
 * Run commands with a minimal secure environment, for safety's sake.

Change-Id: I6b8cb36c7ec2cd256fa2c0a9f85e10d77ad35d8e