[BUG] Interrupted source archive hashing leaves a temporary ZIP

Describe the bug

Cancelling source preparation during the final archive hash leaves a completed temporary ZIP behind. An I/O error while hashing has the same cleanup gap.

To Reproduce

On main at 06015506625a78b981ae0b34be40239fc1b389be, run strix cloud scans start --source <fixture> --dry-run --json with a synthetic file and inject KeyboardInterrupt in the final archive SHA-256 read. The CLI exits 130, but the temporary strix-source-*.zip remains. Injecting an OSError at the same point also leaves the archive. A normal dry run removes it.

Expected behavior

The preparation step owns the temporary archive until it returns a bundle. Any failure before that handoff should remove the ZIP, including a failure during final size or digest computation.

Environment

Python 3.12, macOS, current main, synthetic source, no upload or LLM call.