refactor: Add trap-based cleanup for temp files in library code

Added EXIT traps to ensure temporary files are cleaned up even if scripts crash or are interrupted:

**cli/spawn.sh** (2 mktemp calls):
- Line 219: Added trap after mktemp in fetch_manifest(), clear trap after mv
- Line 537: Added trap after mktemp in cmd_update(), clear trap after mv
- Removed manual rm -f calls in error paths (trap handles cleanup)

**sprite/lib/common.sh** (3 mktemp calls):
- setup_shell_environment(): Consolidated trap for both path_temp and bash_temp
- inject_env_vars_sprite(): Added trap for env_temp, clear after successful upload

**shared/common.sh** (cleanup system):
- Auto-register cleanup trap at end of file when sourced
- This activates the existing track_temp_file() + cleanup_temp_files() system
- Previously register_cleanup_trap() had to be manually called (only 1 script did this)

Impact: Prevents /tmp file leaks when scripts are killed, crashed, or interrupted mid-execution.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

cli/spawn.sh

@@ -217,16 +217,16 @@ ensure_manifest() {
     log_info "Fetching manifest..."
     local tmp
     tmp=$(mktemp)
+    trap 'rm -f "${tmp}"' EXIT
     if curl -fsSL "${SPAWN_RAW_BASE}/manifest.json" -o "${tmp}" 2>/dev/null; then
         if json_validate "${tmp}"; then
             mv "${tmp}" "${SPAWN_MANIFEST}"
+            trap - EXIT  # Clear trap after successful move
             return 0
         else
-            rm -f "${tmp}"
             log_warn "Downloaded manifest is invalid JSON"
         fi
     else
-        rm -f "${tmp}"
         log_warn "Failed to fetch manifest"
     fi
 
@@ -535,29 +535,29 @@ cmd_update() {
     log_info "Checking for updates..."
     local tmp
     tmp=$(mktemp)
+    trap 'rm -f "${tmp}"' EXIT
     if curl -fsSL "${SPAWN_RAW_BASE}/cli/spawn.sh" -o "${tmp}" 2>/dev/null; then
         local remote_version
         remote_version=$(grep '^SPAWN_VERSION=' "${tmp}" | head -1 | cut -d'"' -f2)
         if [[ -z "${remote_version}" ]]; then
-            rm -f "${tmp}"
             log_error "Could not determine remote version"
             exit 1
         fi
 
         if [[ "${remote_version}" == "${SPAWN_VERSION}" ]]; then
-            rm -f "${tmp}"
+            trap - EXIT  # Clear trap, file already cleaned
             log_info "Already up to date (v${SPAWN_VERSION})"
             return 0
         fi
 
         chmod +x "${tmp}"
         mv "${tmp}" "${self}"
+        trap - EXIT  # Clear trap after successful move
         log_info "Updated: v${SPAWN_VERSION} → v${remote_version}"
 
         # Invalidate manifest cache on update
         rm -f "${SPAWN_MANIFEST}"
     else
-        rm -f "${tmp}"
         log_error "Failed to download update"
         exit 1
     fi

shared/common.sh

@@ -1236,3 +1236,10 @@ ensure_ssh_key_with_provider() {
         return 1
     fi
 }
+
+# ============================================================
+# Auto-initialization
+# ============================================================
+
+# Auto-register cleanup trap when this file is sourced
+register_cleanup_trap