Fixes #345

var=foo is a "recursive variable assignment", which is expanded on every
use (including re-running shell commands). What we really want is
var:=foo, which is expanded at definition time.

mktemp seems to also be available on macOS -- though without `--suffix`.