fix(cli): cdk flags --set leaks synthesized cloud assembly directories

[Adityaj0]

fixes #1832

Reason for this change

FlagOperations.prototypeChanges() (packages/aws-cdk/lib/commands/flags/operations.ts) creates two synthesis output directories via fs.mkdtempSync(path.join(os.tmpdir(), 'cdk-original-')) and 'cdk-temp-', but never stores the returned paths anywhere.

cleanupTempDirectories(), called after the user accepts or declines the confirmation prompt, instead removes path.join(process.cwd(), 'original') and path.join(process.cwd(), 'temp') — paths that were never created by this code path at all. It is effectively a no-op, and every cdk flags --set (or --recommended/--default/--all) invocation leaves two full synthesized cloud-assembly directories behind in the OS temp directory, indefinitely.

Description of changes

• Adds originalTempDir/modifiedTempDir instance fields, following the same pattern this class already uses for baselineTempDir on the setSafeFlags code path.
• prototypeChanges() now stores each mkdtemp path on this instead of discarding it.
• cleanupTempDirectories() now removes the actual stored paths (and resets the fields), instead of the unrelated ${cwd}/original / ${cwd}/temp paths.
• Also calls cleanupTempDirectories() on the early "nothing to update" return inside prototypeChanges() (e.g. "flag is already set to the specified value") — that path returns false before handleUserResponse() (the only other place cleanup was wired up) is ever called, so originalTempDir would otherwise still leak even after fixing the main paths.

Description of how you validated changes

Added two regression tests to test/commands/flag-operations.test.ts ('cleans up the real temp directories created during prototyping when the user cancels' / '...when the user accepts') that snapshot os.tmpdir() before and after a full cdk flags --set invocation and assert no cdk-original-*/cdk-temp-* entries remain. fs.mkdtempSync is not mocked in this suite, so these tests exercise real filesystem directory creation/cleanup, not just the mocked toolkit calls.

Verified both new tests fail against the pre-fix code (real leaked directories detected in os.tmpdir()) and pass with the fix. Ran the full flag-operations.test.ts suite 3x with jest's randomized test order (58 tests each run) plus a scan of os.tmpdir() after each run — zero leaked entries across all runs.

Checklist

• Unit tests added/updated
• Integration tests added/updated (not applicable — filesystem-only bug in a CLI-internal helper, fully covered by the new unit tests)
• No manual edits to generated files

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.93%. Comparing base (a826ad8) to head (e97a627).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1833   +/-   ##
=======================================
  Coverage   90.92%   90.93%           
=======================================
  Files          80       80           
  Lines       12226    12237   +11     
  Branches     1750     1752    +2     
=======================================
+ Hits        11117    11128   +11     
  Misses       1073     1073           
  Partials       36       36           

Flag	Coverage Δ
suite.unit	90.93% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.