Fix leaks in /tmp

In a recent discussion with my team, we discovered that our shared dev environment is filled with `/tmp/rules_go_work-XXXXX` not being clean up.


I think this is because we are currently calling the cleanup function for this tmpdir in a `defer()` statement, which will not be executed if somewhere down the stack `log.Fatalf()` is called.

We should ensure that either `fatal` is only used in the outer `main()` func, or we have a reliable cleanup that survives `os.Exit` and `log.Fatal`

Start by tracing the tmpdir cleanup function and the call sites that use fatal, especially the outer main() entry point mentioned in the issue. Confirm the cleanup behavior on fatal exits and ensure the relevant exit paths no longer leave /tmp/rules_go_work-XXXXX directories behind.

Written by the indexing model from the issue text.