Fix temp directory leak in all CLI commands

[johnallers]

Summary

• Add missing defer store.Close(ctx) calls across all CLI commands that load a C1Z file. Without this, the decompressed SQLite temp directory (c1z*/db) created by decompressC1z() is never cleaned up — only the temp c1z copy file (sync-*.c1z) was being removed by m.Close().
• Fix bug in principals_compare.go where defer m.Close(ctx) was called twice instead of closing mCompare.
• Add missing defer m.Close(ctx) in c1z.go export command.

Affected commands: stats, syncs, entitlements, resources, resource-types, principals, principals compare, grants, access, diff, csv, xlsx, c1z.

Note: When running repeated operations on large syncs (especially on Windows, where the OS does not aggressively clean temp directories), the leaked temp files accumulate quickly and can exhaust disk space.

Test plan

• Run baton stats and verify no leftover c1z* directories remain in the system temp folder
• Run baton resources, baton grants, and other subcommands and confirm temp cleanup
• Verify baton principals compare correctly closes both managers and stores
• Test on Windows to confirm temp directory accumulation is resolved

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (13)

• cmd/baton/access.go is excluded by none and included by none
• cmd/baton/c1z.go is excluded by none and included by none
• cmd/baton/csv.go is excluded by none and included by none
• cmd/baton/diff.go is excluded by none and included by none
• cmd/baton/entitlements.go is excluded by none and included by none
• cmd/baton/grants.go is excluded by none and included by none
• cmd/baton/principals.go is excluded by none and included by none
• cmd/baton/principals_compare.go is excluded by none and included by none
• cmd/baton/resource_types.go is excluded by none and included by none
• cmd/baton/resources.go is excluded by none and included by none
• cmd/baton/stats.go is excluded by none and included by none
• cmd/baton/syncs.go is excluded by none and included by none
• cmd/baton/xlsx.go is excluded by none and included by none

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 91ad8822-ac47-43b0-afbc-a314fc255a7c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch jallers/cleanup

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[ggreer]

A test case would be nice too. Also this codebase should probably get merged into the baton-sdk repo so we don't forget to update baton-sdk in it.