Add always condition to finalize step, fix audit, and update bash test to use real path

[Unshure]

Description

Add always() so that label cleanup always happens

example where we need this: https://github.com/strands-agents/sdk-python/actions/runs/21530320818/job/62044415203

• Additionally fix an audit issue
• Update bash test to use real path

Related Issues

N/A

Documentation PR

N/A

Type of Change

Bug fix

Testing

How have you tested the change?

• I ran npm run check

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[mehtarac]

Integ test timed out: test/integ/agent.test.ts > Agent with 'BedrockModel' > BedrockModel Integration Tests > handles tool invocation Error: Test timed out in 60000ms.. Non-blocker