fix(cloud): clean up source archives when hashing fails

Fixes #1682.

prepare_source() removed its temporary ZIP when archive writing failed, but size inspection and SHA-256 hashing happened outside that cleanup boundary. An interruption during hashing returned exit 130 while leaving the completed archive behind; an I/O error also escaped the CLI's structured error handling. The caller cannot remove the ZIP because it has not received a SourceBundle yet.

Keep ownership of the temporary archive until size validation and hashing finish. Remove it on failure, preserve interruption handling, and translate I/O errors into the existing CloudError response. Oversize errors retain their current exclusion guidance.

Validation on Python 3.12.14, using the frozen base environment with an isolated HOME and local fixtures:

• Four new CLI regressions fail on unchanged 06015506625a78b981ae0b34be40239fc1b389be: size inspection and digest calculation, each interrupted or raising an I/O error. They build real ZIPs, inject only the failure, and check cleanup plus JSON/exit-code behavior. All four pass after the patch.
• Cloud and local-source suites: 352 passed. The first sandboxed run had 342 passes and 10 failures because mocked wallet listeners could not bind loopback ports; the complete rerun with loopback access passed without changing or skipping tests.
• Repository Ruff lint and format checks pass (253 files); Mypy passes for source_upload.py; Bandit reports no findings in that module; git diff --check passes.

No managed-cloud request, model call, payment, Docker scan or real target was used. Full-repository pytest, full make check-all, Windows execution and actual storage failures were not exercised; failure-path coverage uses injected exceptions at the filesystem/digest boundaries. The temporary ZIP remained owner-only (0600) in the local reproduction, so this report does not claim cross-user exposure.

Prepared with AI assistance.