fix(fpagent): sweep scratch left by a SIGKILLed installer run

The EXIT trap cannot run on SIGKILL, so a killed run could leave its
fpagent-install.* temp dir behind. Sweep those before any network work,
scoped to our prefix and this user and only dirs older than a day so a
concurrent install is never touched.

tools/public/fpagent/install.sh

@@ -51,10 +51,18 @@ for arg in "$@"; do
 	esac
 done
 
-for cmd in curl tar sha256sum python3; do
+for cmd in curl tar sha256sum python3 find; do
 	command -v "$cmd" >/dev/null 2>&1 || die "$cmd is required but not installed"
 done
 
+tmpbase="${TMPDIR:-/tmp}"
+# Sweep scratch left by an earlier run that was SIGKILLed: the EXIT trap cannot
+# run then (that is the one signal it cannot catch). Scoped to our own prefix,
+# this user, and dirs older than a day, so a concurrent install is never touched.
+# Runs before any network work so cleanup is not skipped when the fetch fails.
+find "$tmpbase" -maxdepth 1 -mindepth 1 -type d -uid "$(id -u)" \
+	-name 'fpagent-install.*' -mtime +0 -exec rm -rf {} + 2>/dev/null || true
+
 # Offline bundles ship the libfprint .deb closure for a specific Ubuntu
 # release; prefer the one matching this machine, else fall back to the generic
 # online bundle (whose installer apt-get's the dependency).
@@ -85,7 +93,7 @@ asset="${readout#*$'\t'}"
 say "  release ${tag}"
 say "  bundle  ${asset}"
 
-tmp="$(mktemp -d)"
+tmp="$(mktemp -d "$tmpbase/fpagent-install.XXXXXXXX")"
 trap 'rm -rf "$tmp"' EXIT
 
 get() { curl -fsSL "$1" -o "$2" || die "download failed: $1"; }