test: temp dirs are removed even when a test fails; lint guards it (#646)

golden-capture-provenance accept() left a ~20 MB baselines sandbox in
TMPDIR on every call (433 copies, 8.5 GB, ENOSPC in the shared sandbox).
It now reads what it needs and removes the sandbox in finally; fixtures
are removed via t.after. Same fix for the three other leaking sites
(bundle-assets hp-tree-, docs-accept hp-identical-, rebase-generated
hp-runner- outside finally).

test/temp-dir-hygiene.test.mjs parses test/**/*.mjs with the TypeScript
AST: every mkdtemp/mkdtempSync must be bound to a name removed by
rm*/rmSync in a finally block or an after/afterEach/t.after hook of the
same function, or returned by a named helper whose every call site does
so; exception `// tmp-ok: <reason>`. Two mutants witness the lint.

Issue: #646
User-Visible: no

scripts/mutation-registry.mjs

@@ -2988,6 +2988,28 @@ const MUTANT_DEFINITIONS = [
       replace: '            pass',
     }],
   },
+  {
+    id: 'golden-accept-sandbox-leaks',
+    guard: 'node --test test/temp-dir-hygiene.test.mjs',
+    because: 'the ~20 MB baselines sandbox of accept() outliving every call is what filled the '
+      + 'shared TMPDIR to 8.5 GB and ENOSPC (#646 AC2)',
+    patches: [{
+      file: 'test/golden-capture-provenance.test.mjs',
+      find: '    rmSync(sandbox, { recursive: true, force: true });',
+      replace: '    // sandbox is left for inspection',
+    }],
+  },
+  {
+    id: 'temp-hygiene-accepts-cleanup-outside-finally',
+    guard: 'node --test test/temp-dir-hygiene.test.mjs',
+    because: 'a trailing rmSync after the asserts does not run when an assert fails, so a red '
+      + 'test still leaks; the lint must not count it as cleanup (#646 AC2)',
+    patches: [{
+      file: 'test/temp-dir-hygiene.test.mjs',
+      find: 'function inCleanupPosition(node, scope) {',
+      replace: 'function inCleanupPosition(node, scope) {\n  if (node) return true;',
+    }],
+  },
   {
     id: 'ha-harness-notice-silent',
     guard: 'python3 -m pytest tests_backend/test_conftest_harness_notice.py -q -p no:cacheprovider',