I'm attaching my "proposed" version, which isn't quite in the state I
want it to be committed, but it addresses a few issues, some of which
I tried to explain before but which are difficult without just showing
it...

Some notes:

- The public header in which a public function is defined should
  always be included in the file with the definition, to ensure the
  prototype matches if nothing else.

- Nonstandard functions should be protected in the headers, not
  exposed in the default namespace. Technically mkostemp is
  nonstandard, but it's accepted for inclusion in Issue 8, and so far
  the policy for such functions is to treat them as if they're already
  in the standard.

- Using the LFS64 macro when _GNU_SOURCE is defined breaks due to the
  #defines in the system headers. This is a bug in musl, but I worked
  around it by using _BSD_SOURCE instead which doesn't expose the *64
  junk.

- O_RDWR needs to be builtin to the tempfile-creation core (now
  __mkostemps), not passed in by the caller. The flags argument is
  only for additional flags, and the proposed text in POSIX is clear
  that passing anything but a small limited set of flags yields
  unspecified behavior.

- I'm using __clock_gettime rather than clock_gettime so that these
  functions can hopefully eventually be shared with the code for
  tmpfile and tmpnam, which are in ISO C and can't depend on POSIX
  namespace. However the issue of using open still remains; it should
  perhaps be changed to make the syscall directly like tmpfile does
  now. This can be changed later; it's not a big deal.

I have not addressed any of the randomness considerations; I just
copied the code for that from your latest patch. Comments on the ml
should still be taken into consideration for finalizing that.

Rich