fix(cli): sweep stale Bun-extracted temp libraries at startup

[WakaTaira]

What

Bun single-file executables extract their embedded native libraries into the OS temp directory under a randomized hidden name (.{16hex}-{8hex}.so|dylib|dll) on every launch, and never reuse or remove them (oven-sh/bun#30962). For hunk this means every invocation leaks one copy of the OpenTUI native library — #556 documented 81,653 files (~190 GB) in three weeks via the lazygit pager integration; I hit a full 16 GB tmpfs overnight on Linux with an agent polling hunk session every 2 s.

This PR adds a best-effort startup sweep that reaps hunk's stale leaked artifacts until Bun's extraction dedupe (oven-sh/bun#29587) ships — at which point this module can be deleted outright.

How

• New src/core/tmpArtifactSweep.ts (DI-friendly, colocated tests): removes hidden .{16hex}-{8hex}.(so|dylib|dll) regular files in the temp directory root, owned by the current user and older than one hour.
• Rate-limited to one directory scan per hour via a stamp file, claimed before the scan so concurrent starts don't all readdir.
• Hardened for shared /tmp: the stamp must be a regular file owned by the current user — a symlinked or foreign-owned stamp aborts the sweep; first creation is an exclusive write.
• Wired in main(): the sweep starts before argument parsing, and short-lived commands await it right before process.exit (which would otherwise drop the pending work). The app and daemon paths never block on it.
• All errors swallowed, no output. Opt out with HUNK_DISABLE_TMP_SWEEP=1.

Verification

• typecheck / test / lint / format:check all pass (9 new unit tests).
• End-to-end on Linux: a compiled hunk binary leaks exactly one new artifact per --help run (reproducing the bug); with this patch it removes planted stale artifacts, keeps fresh ones, honors the opt-out, and respects the rate-limit stamp.

Refs #556.

[greptile-apps]

PR author is not in the allowed authors list.

[vercel]

@WakaTaira is attempting to deploy a commit to the Modem Team on Vercel.

A member of the Team first needs to authorize it.

[WakaTaira]

Rebased onto the latest main to resolve the conflict with the recent module reorg (app/startup, session/*) — the sweep itself is unchanged. typecheck, test (1767 pass), lint, and format:check all pass locally.

One honest observation: at some point the leak seems to have stopped occurring on my machine — I no longer notice new artifacts accumulating. I haven't investigated why (I'm on 0.17.7, which predates #590's headless lazy-load, so that shouldn't be the reason), so it may be environmental. Sharing as anecdotal signal in case it's useful when deciding how this and #577 fit together.