fix(scan): delete generated .socket.facts.json after reach submit

[John-David Dalton (jdalton)]

socket scan create --reach runs coana, which writes .socket.facts.json into the project, uploads it, and then left it sitting there. Martin: "you don't really want .socket.facts.json files lying around in your folder."

Change

Delete the facts file once the scan is submitted — but only when this run generated it.

Case	Behavior
CLI generated the file this run	deleted after successful submit
File pre-existed the run	left untouched
--reach-use-only-pregenerated-sboms (user-managed artifacts)	left untouched
Submission failed	left in place (debuggability)

"Generated this run" is decided by snapshotting existsSync(.socket.facts.json) before the analysis runs (the create flow always writes coana's report to the default path in cwd), plus the explicit pregenerated-SBOMs flag.

Failure path

Kept, not deleted — a failed submit is exactly when you want the artifact around to inspect. The delete is already gated on fullScanCResult.ok.

Tests

Consolidated the facts-cleanup unit tests into handle-create-new-scan.test.mts and rewrote them to assert real on-disk state (tmp cwd + real safeDelete) instead of a mocked delete. Covers all four rows above.

Test Files  2 passed (2)
      Tests  18 passed (18)

Full scan unit dir: 72 files / 812 tests green. Lint + oxfmt clean on the three touched files.

---

Note

Low Risk
CLI-only post-upload file cleanup with narrow conditions; behavior is covered by integration-style unit tests and does not touch auth or server APIs.

Overview
Reach scan create no longer leaves .socket.facts.json in the project after a successful upload when this run produced it.

Deletion is gated on a new generatedFactsFile flag: snapshot existsSync before reachability runs, and skip cleanup when --reach-use-only-pregenerated-sboms is set or the file was already on disk. Failed submits still keep the file for debugging.

Unit tests for the four cleanup cases moved to handle-create-new-scan.test.mts and now assert real on-disk state via a temp cwd instead of mocking safeDelete.

^{Reviewed by Cursor Bugbot for commit e55eceb. Configure here.}