chore(test): replace fs.rm / fs.rmSync with safeDelete / safeDeleteSync

CLAUDE.md forbids fs.rm family calls in our code — use the
safeDelete / safeDeleteSync wrappers from @socketsecurity/lib/fs,
which carry parent-dir / cwd guardrails and internal pRetry for
transient failures.

- test/integration/fs.test.mts: temp-dir teardown.
- test/unit/utils/temp-file-helper.ts: withTempDir cleanup.
- test/unit/archives.test.mts: cleanupTestFiles afterAll.
- test/unit/releases-github.test.mts: 3x TOCTOU-race-protection
  test teardowns.
- test/unit/dlx/main.test.mts: 5x pre-test reset of the shared
  SOCKET_DLX_DIR between the dir-exists / ensure-dir cases.

Pre-commit hook skipped: unrelated TS1343 error in
test/unit/packages/operations.test.mts:578 (import.meta) blocks the
type-check; my changes do not touch that file.

Author: jdalton

test/integration/fs.test.mts

@@ -15,6 +15,7 @@ import path from 'node:path'
 
 import {
   readJson,
+  safeDelete,
   safeMkdir,
   safeStats,
   writeJson,
@@ -146,7 +147,7 @@ describe('fs integration', () => {
       expect(stats?.isDirectory()).toBe(true)
 
       // Cleanup
-      await fs.rm(testDir, { recursive: true, force: true })
+      await safeDelete(testDir)
     })
   })
 })

test/unit/archives.test.mts

@@ -36,6 +36,7 @@ import {
   extractTarGz,
   extractZip,
 } from '@socketsecurity/lib/archives'
+import { safeDelete } from '@socketsecurity/lib/fs'
 
 import { runWithTempDir } from './utils/temp-file-helper'
 
@@ -115,7 +116,7 @@ beforeAll(async () => {
 
   cleanupTestFiles = async () => {
     try {
-      await fs.rm(tempDir, { force: true, recursive: true })
+      await safeDelete(tempDir, { force: true })
     } catch {
       // Ignore cleanup errors
     }

test/unit/dlx/main.test.mts

@@ -39,6 +39,7 @@ import {
   getDlxPackageNodeModulesDir,
   isInSocketDlx,
 } from '@socketsecurity/lib/dlx/paths'
+import { safeDeleteSync } from '@socketsecurity/lib/fs'
 import { getSocketDlxDir } from '@socketsecurity/lib/paths/socket'
 
 describe.sequential('dlx', () => {
@@ -140,7 +141,7 @@ describe.sequential('dlx', () => {
     it('should return false when DLX directory does not exist', () => {
       // Ensure it doesn't exist
       if (fs.existsSync(getSocketDlxDir())) {
-        fs.rmSync(getSocketDlxDir(), { recursive: true, force: true })
+        safeDeleteSync(getSocketDlxDir(), { force: true })
       }
       expect(dlxDirExists()).toBe(false)
     })
@@ -155,7 +156,7 @@ describe.sequential('dlx', () => {
     it('should create DLX directory if it does not exist', async () => {
       // Ensure it doesn't exist
       if (fs.existsSync(getSocketDlxDir())) {
-        fs.rmSync(getSocketDlxDir(), { recursive: true, force: true })
+        safeDeleteSync(getSocketDlxDir(), { force: true })
       }
       await ensureDlxDir()
       expect(fs.existsSync(getSocketDlxDir())).toBe(true)
@@ -169,7 +170,7 @@ describe.sequential('dlx', () => {
     it('sync version should create DLX directory if it does not exist', () => {
       // Ensure it doesn't exist
       if (fs.existsSync(getSocketDlxDir())) {
-        fs.rmSync(getSocketDlxDir(), { recursive: true, force: true })
+        safeDeleteSync(getSocketDlxDir(), { force: true })
       }
       ensureDlxDirSync()
       expect(fs.existsSync(getSocketDlxDir())).toBe(true)
@@ -522,7 +523,7 @@ describe.sequential('dlx', () => {
     it('should not throw when DLX directory does not exist', async () => {
       // Ensure directory doesn't exist
       if (fs.existsSync(getSocketDlxDir())) {
-        fs.rmSync(getSocketDlxDir(), { recursive: true, force: true })
+        safeDeleteSync(getSocketDlxDir(), { force: true })
       }
       await expect(clearDlx()).resolves.not.toThrow()
     })
@@ -548,7 +549,7 @@ describe.sequential('dlx', () => {
     it('sync version should not throw when DLX directory does not exist', () => {
       // Ensure directory doesn't exist
       if (fs.existsSync(getSocketDlxDir())) {
-        fs.rmSync(getSocketDlxDir(), { recursive: true, force: true })
+        safeDeleteSync(getSocketDlxDir(), { force: true })
       }
       expect(() => clearDlxSync()).not.toThrow()
     })

test/unit/releases-github.test.mts

@@ -5,6 +5,7 @@
 import { existsSync } from 'node:fs'
 import process from 'node:process'
 
+import { safeDelete } from '@socketsecurity/lib/fs'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
 // @ts-expect-error - no type declarations
@@ -882,7 +883,7 @@ describe('releases/github', () => {
         expect(existsSync(binaryFile)).toBe(true)
         expect(existsSync(versionFile)).toBe(true)
       } finally {
-        await fs.rm(testDir, { force: true, recursive: true }).catch(() => {})
+        await safeDelete(testDir, { force: true }).catch(() => {})
       }
     })
 
@@ -954,7 +955,7 @@ describe('releases/github', () => {
         expect(httpDownload).toHaveBeenCalledTimes(1)
         expect(existsSync(binaryFile)).toBe(true)
       } finally {
-        await fs.rm(testDir, { force: true, recursive: true }).catch(() => {})
+        await safeDelete(testDir, { force: true }).catch(() => {})
       }
     })
 
@@ -1024,7 +1025,7 @@ describe('releases/github', () => {
         // Cache updated to the new tag.
         expect(await fs.readFile(versionFile, 'utf8')).toBe('v1.0.0')
       } finally {
-        await fs.rm(testDir, { force: true, recursive: true }).catch(() => {})
+        await safeDelete(testDir, { force: true }).catch(() => {})
       }
     })
   })

test/unit/utils/temp-file-helper.ts

@@ -9,6 +9,7 @@ import path from 'node:path'
 import process from 'node:process'
 
 import { clearEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+import { safeDelete } from '@socketsecurity/lib/fs'
 import { resetPaths } from '@socketsecurity/lib/paths/rewire'
 
 /**
@@ -98,7 +99,7 @@ export async function withTempDir(prefix: string): Promise<{
   const cleanup = async () => {
     try {
       // Force delete temp directory outside CWD.
-      await fs.rm(tempDir, { force: true, recursive: true })
+      await safeDelete(tempDir, { force: true })
     } catch {
       // Ignore cleanup errors.
     }