I suppose I could have just logged in to my HP-UX computer to confirm. So now I do that. It indeed has an incompatible version of mktemp that happens to be even worse than the option that I proposed; here is the relevant section of the man page.
The name generated by mktemp is the concatenation of a directory name, a slash (/), the value of the LOGNAME environment variable truncated to {NAME_MAX} - 6 characters, and the process ID of the invoking process. But this is from version 11.11, so I suppose it would be acceptable not to care about it.