test: temp dirs are removed even when a test fails; lint guards it (#646)

golden-capture-provenance accept() left a ~20 MB baselines sandbox in
TMPDIR on every call (433 copies, 8.5 GB, ENOSPC in the shared sandbox).
It now reads what it needs and removes the sandbox in finally; fixtures
are removed via t.after. Same fix for the three other leaking sites
(bundle-assets hp-tree-, docs-accept hp-identical-, rebase-generated
hp-runner- outside finally).

test/temp-dir-hygiene.test.mjs parses test/**/*.mjs with the TypeScript
AST: every mkdtemp/mkdtempSync must be bound to a name removed by
rm*/rmSync in a finally block or an after/afterEach/t.after hook of the
same function, or returned by a named helper whose every call site does
so; exception `// tmp-ok: <reason>`. Two mutants witness the lint.

Issue: #646
User-Visible: no

test/bundle-assets.test.mjs

@@ -709,12 +709,13 @@ test('#535 no built entry reaches the card by an address without a version', ()
     'сам фасад остаётся стабильным входом Lovelace-ресурса и тянет хешированный чанк');
 });
 
-test('bundle tree verification rejects orphan chunks (#353 AC4)', async () => {
+test('bundle tree verification rejects orphan chunks (#353 AC4)', async (t) => {
   const { mkdtempSync, writeFileSync, mkdirSync } = await import('node:fs');
   const { tmpdir } = await import('node:os');
   const { join } = await import('node:path');
   const { verifyBundleTree, sha256Bytes } = await import('../scripts/bundle-tree.mjs');
   const root = mkdtempSync(join(tmpdir(), 'hp-tree-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
   mkdirSync(join(root, 'houseplan-assets'));
   const entryCode = 'try{await import("./houseplan-assets/main-abc.js")}catch(e){}';
   const panelCode = 'try{await import("./houseplan-card.js")}catch(e){}';