fix(11.1-06): remove the docs gate's scratch directories on a refusal

- a refusal exits from inside a stage, where the RETURN trap never ran,
  leaving the self-test's 48 MB scratch copy in /tmp; an EXIT trap now
  removes every stage's scratch paths
- the self-test copies examples/ with tar, excluding examples/*/bin,
  instead of git ls-files, so a PHASE11_1_ROOT copy without .git works

scripts/check-phase11.1.sh

@@ -14,6 +14,15 @@
 # renamed test and "no tests to run" all refuse.
 set -euo pipefail
 
+# Scratch paths made by the stages. A refusal exits from inside a stage,
+# where the stage's RETURN trap does not run, so they are also removed on
+# exit.
+SCRATCH=()
+cleanup() {
+	[ "${#SCRATCH[@]}" -eq 0 ] || rm -rf "${SCRATCH[@]}"
+}
+trap cleanup EXIT
+
 ROOT="${PHASE11_1_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
 PHASE11_DIR="$ROOT/.planning/phases/11-jobs-realtime-and-search-infrastructure"
 DEPS_BASE="${PHASE11_1_DEPS_BASE:-9033d81}"
@@ -73,6 +82,7 @@ for r in json.load(sys.stdin).get("Require") or []:
 run_deps() {
 	local tmp base now removed added dep
 	tmp="$(mktemp -d)"
+	SCRATCH+=("$tmp")
 	trap 'rm -rf "$tmp"' RETURN
 	git -C "$ROOT" show "$DEPS_BASE:go.mod" >"$tmp/base.mod"
 	cp "$ROOT/go.mod" "$tmp/now.mod"
@@ -102,6 +112,7 @@ sys.exit(0 if direct else 1)
 run_docs() {
 	local tmp site name
 	tmp="$(mktemp -d)"
+	SCRATCH+=("$tmp")
 	trap 'rm -rf "$tmp"' RETURN
 	build_summer "$tmp/summer"
 	site="$tmp/site"
@@ -124,6 +135,7 @@ forbidden_hits() {
 run_forbidden() {
 	local tmp hits
 	tmp="$(mktemp -d)"
+	SCRATCH+=("$tmp")
 	trap 'rm -rf "$tmp"' RETURN
 	build_summer "$tmp/summer"
 	(cd "$ROOT" && "$tmp/summer" docs:build --root "$ROOT" --out "$tmp/site" >/dev/null) || refuse "docs:build failed"
@@ -212,6 +224,7 @@ go_json_named() {
 		require+="$import $name"$'\n'
 	done
 	log="$(mktemp)"
+	SCRATCH+=("$log")
 	(cd "$ROOT" && go test -json -count=1 "$pkg" -run "^($names)\$" >"$log" 2>&1) || code=$?
 	if ! PHASE11_1_REQUIRE="$require" detect_json "$log"; then
 		rm -f "$log"
@@ -244,6 +257,7 @@ run_self_test() {
 	bash -n "${BASH_SOURCE[0]}"
 	local tmp scratch pristine summer
 	tmp="$(mktemp -d)"
+	SCRATCH+=("$tmp")
 	trap 'rm -rf "$tmp"' RETURN
 	scratch="$tmp/root"
 	pristine="$tmp/pristine"
@@ -252,8 +266,8 @@ run_self_test() {
 	mkdir -p "$scratch" "$pristine"
 	cp -R "$ROOT/docs" "$ROOT/modules" "$ROOT/go.mod" "$ROOT/go.sum" "$ROOT/README.md" "$scratch/"
 	# The command checker reads bonfire.Command literals under examples/
-	# (the tracked files only: examples/hello/bin holds built binaries).
+	# (built binaries under examples/*/bin are left out).
-	git -C "$ROOT" ls-files -z examples | tar -C "$ROOT" --null -T - -cf - | tar -C "$scratch" -xf -
+	tar -C "$ROOT" --exclude='examples/*/bin' -cf - examples | tar -C "$scratch" -xf -
 	cp -R "$ROOT/docs" "$pristine/"
 
 	(cd "$scratch" && GOWORK=off "$summer" docs:build --check --root "$scratch" >/dev/null) ||