release: cleanup temp error files on workflow exits

Author: tazarov

.github/workflows/rust-release.yml

@@ -297,6 +297,7 @@ jobs:
           set -euo pipefail
           PREFIX="s3://${BUCKET}/${PROJECT}/${VERSION}/"
           immutability_check_err="/tmp/immutability-check.err"
+          trap 'rm -f "${immutability_check_err}"' EXIT
           if ! existing_prefix_listing="$(aws s3 ls "${PREFIX}" --endpoint-url "${R2_ENDPOINT}" 2>"${immutability_check_err}")"; then
             echo "Failed to check release immutability for ${PREFIX}." >&2
             cat "${immutability_check_err}" >&2
@@ -316,6 +317,8 @@ jobs:
           AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
         run: |
           set -euo pipefail
+          releases_fetch_err="/tmp/releases-fetch.err"
+          trap 'rm -f "${releases_fetch_err}"' EXIT
           aws s3 cp dist/ "s3://${BUCKET}/${PROJECT}/${VERSION}/" \
             --recursive \
             --endpoint-url "${R2_ENDPOINT}"
@@ -335,7 +338,6 @@ jobs:
 
           # Maintain bounded project release history for clients that need more than latest.json.
           # This logic is externalized to a script so it can be tested locally.
-          releases_fetch_err="/tmp/releases-fetch.err"
           if ! aws s3 cp "s3://${BUCKET}/${PROJECT}/releases.json" /tmp/releases-existing.json \
             --endpoint-url "${R2_ENDPOINT}" 2>"${releases_fetch_err}"; then
             if grep -qiE '404|NoSuchKey' "${releases_fetch_err}"; then