chore: replace fs.rm with safeDelete

[John-David Dalton (jdalton)]

Summary

CLAUDE.md forbids `fs.rm` / `fs.rmSync` / `rm -rf` in our code — use `safeDelete` from `@socketsecurity/lib/fs`.

Fixes:

• `packages/cli/scripts/sync-checksums.mts` — 3 call sites (cleanup after parsing checksums.txt + error path + finally block).
• `.claude/hooks/setup-security-tools/index.mts` — 1 call site (zizmor extract-dir cleanup).

Test plan

• `pnpm run lint` + `pnpm run type` clean.
• `node packages/cli/scripts/sync-checksums.mts --dry-run` still works.

---

Note

Low Risk
Low risk refactor: only changes temp directory cleanup in two scripts, with no impact to core business logic beyond how deletions are performed.

Overview
Replaces recursive temp-directory cleanup using fs.rm(..., { recursive: true }) with safeDelete from @socketsecurity/lib/fs.

This updates cleanup paths in the zizmor extraction flow (.claude/hooks/setup-security-tools/index.mts) and in the checksum sync script (packages/cli/scripts/sync-checksums.mts), including normal, error, and finally cleanup branches.

^{Reviewed by Cursor Bugbot for commit f0ccde5. Configure here.}

[John-David Dalton (jdalton)]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit f0ccde5. Configure here.}