test: sweep mkdtempSync scratch roots that never register teardown

[ken-jo]

Context

Follow-up to #1998.

#1998 covered tests that already had bare recursive rmSync teardown and moved those teardown sites onto cleanupTmpDir. This is a separate defect class: scratch roots created by mkdtempSync that currently never register teardown at all.

Pinned audit: origin/main@49c8c1b5f4230c4a5549485ec76dd7139da6dafd

Result:

• 28 test files
• 92 reachable static allocator sites
• Helper and parameterized sites may execute more than once, so this is not a runtime directory count.

Inventory

Boot — 4 files / 34 sites

• src/boot/steps/__tests__/plugin-runtime-auth-partition.test.ts: 167, 183, 198, 213
• src/boot/steps/__tests__/plugin-runtime-hostapi-wiring.test.ts: 275, 293, 323, 345, 346, 387, 418, 466, 519, 599, 649, 678, 695, 737, 808, 848
• src/boot/steps/__tests__/plugin-runtime-live-main-window.test.ts: 181
• src/boot/steps/__tests__/plugin-runtime.test.ts: 636, 811, 914, 998, 1064, 1146 (mkdtempSyncOs alias), 1213, 1347, 1457, 1527, 1608, 1725, 1797

IPC — 3 files / 4 sites

• src/ipc/__tests__/plugin-theme-replay.test.ts: 59
• src/ipc/__tests__/usage.test.ts: 233
• src/ipc/domains/__tests__/permissions.test.ts: 367, 474

Main — 2 files / 4 sites

• src/main/__tests__/release-prep.test.ts: 548, 569, 586
• src/main/host-api/__tests__/resolve-api-key.test.ts: 32

Permissions — 13 files / 33 sites

• src/permissions/__tests__/deferred-queue.test.ts: 8
• src/permissions/__tests__/host-fetch-verb-snapshot.test.ts: 189
• src/permissions/__tests__/hostapi-effect-completeness.test.ts: 167
• src/permissions/__tests__/permission-manager-legacy-null-verdict.test.ts: 54
• src/permissions/__tests__/permission-manager-reviewer.test.ts: 34
• src/permissions/__tests__/permission-review-scenario-board.test.ts: 34
• src/permissions/__tests__/permission-settings-store-664-migration.test.ts: 122, 152
• src/permissions/__tests__/permission-slash-reviewer.test.ts: 21
• src/permissions/__tests__/permission-slash.test.ts: 20, 193, 220, 236, 256, 273, 416
• src/permissions/__tests__/sandbox-write-jail.test.ts: 16, 22, 23, 34, 35, 36, 51, 58, 67, 80
• src/permissions/__tests__/sensitive-paths-canonicalize.test.ts: 27, 37, 47, 60, 82
• src/permissions/__tests__/sensitive-paths.test.ts: 342
• src/permissions/__tests__/verdict-cache.test.ts: 28

Plugins — 3 files / 10 sites

• src/plugins/__tests__/plugin-app-visibility-guard.test.ts: 20
• src/plugins/runtime/__tests__/runtime-state-incarnation.test.ts: 53, 79, 109, 137, 164, 186, 196, 220
• src/plugins/whitelist/__tests__/secret-gate.test.ts: 174

Tools — 3 files / 7 sites

• src/tools/__tests__/executor-plugin-read-relaxation.test.ts: 495
• src/tools/__tests__/executor.test.ts: 421, 464, 565
• src/tools/__tests__/powershell-binshell.test.ts: 65, 81, 92

Writer/lifecycle constraint

Do not delete a root until all filesystem users are closed or drained.

VerdictCache.lookup() currently schedules an unawaited rewrite when it prunes stale or expired entries:

• production path: src/permissions/reviewer/verdict-cache.ts:283,286,347-350
• direct triggers: src/permissions/__tests__/verdict-cache.test.ts:241,255,268
• additional stale-lookup paths to audit: src/permissions/__tests__/permission-manager-reviewer.test.ts:278,558,592

Provide an awaitable rewrite drain/flush contract, or otherwise establish an explicit completion boundary, before adding directory cleanup to these tests. cleanupTmpDir retry alone is not a writer-drain contract.

Other candidate storage/cache operations were synchronous or awaited, and mocked workers/resources were disposed in their tests.

Acceptance criteria

• Split implementation by owning area; do not create one cross-area test PR.
• Assign every created root to a variable and register it for cleanup immediately, before any operation that may throw.
• Use try/finally, an afterEach root registry, or a returned fixture cleanup contract as appropriate.
• Use cleanupTmpDir; do not introduce bare recursive rmSync.
• Drain pending writers and dispose resource handles before deleting their roots.
• Preserve persistence assertions within each test; no listed directory needs to survive suite completion.
• Run each owning-area suite and the full CI matrix.
• Re-run the pinned allocator/cleanup audit and confirm none of the listed sites remains without teardown.

Reproduction

From the pinned commit:

git grep -n -E 'mkdtempSync(Os)?[[:space:]]*\(' \
  49c8c1b5f4230c4a5549485ec76dd7139da6dafd \
  -- 'src/**/*.test.ts' 'src/**/*.spec.ts'

The inventory above is the result after tracing each allocator to its owning test/fixture and excluding already-registered teardown and non-executed lazy callbacks.

Notable exclusions:

• src/ipc/domains/__tests__/permissions.test.ts:156 is a lazy getAuditDir mock callback not invoked by the current suite.
• permissions.test.ts:382,417 already use try/finally + cleanupTmpDir.
• permission-review-scenario-board.test.ts:42 returns a cleanup closure awaited by every caller.
• marketplace-generation-coordination.test.ts registers both roots in its afterEach cleanup array.

[ken-jo]

Closing as complete.

Pinned final audit: origin/main@dd4e3b0a4cf6a994d64d26c5c38cf66dbb8a4949.

Implementation landed by owning area:

• Boot, 34 sites: Clean boot runtime test scratch directories #2035
• IPC, 4 sites: Clean up IPC test temp roots #2032
• Main, 4 sites: Clean up main test temp roots #2031
• Permissions, 33 sites plus the VerdictCache drain contract: Drain permission cache rewrites before test cleanup #2036
• Plugins, 10 sites: test: close plugin scratch leaks #2033
• Tools, 7 sites: test: clean temporary tool directories #2037

All six exact PR heads and merge commits are ancestors of the pinned origin/main.

Independent closeout audit:

• Original inventory: 28 files / 92 reachable allocator sites
• Sites entering immediate cleanup ownership: 92/92
• Remaining reachable no-cleanup sites: 0
• All filesystem cleanup is awaited.
• Pending writers and resources are flushed, drained, or disposed before their roots are removed.
• PermissionTestResources flushes tracked resources before directory cleanup.
• VerdictCache.flush() drains all tracked background rewrites and has regression coverage preventing post-cleanup directory recreation.
• Plugin incarnation teardown orders deactivate/dispose/drain before cleanupTmpDir.

The previously excluded lazy getAuditDir allocator in src/ipc/domains/tests/permissions.test.ts remains uninvoked by the current suite and is not part of the reachable 92-site inventory.

Scope-integrity checks also remain clean:

• The test: sweep the remaining mkdtemp + bare rmSync teardowns onto cleanupTmpDir #1998 residual executable recursive rmSync set remains exactly 12 test files / 21 calls: 20 deliberate behavior probes and one synchronous construction rollback.
• Bare recursive fixture teardown remaining: 0.

No remaining work is required for this issue.