Add CI check to check that `ensure_clean` is used instead of `os.remove`

[MarcoGorelli]

xref #34385 (review)

This could also be a pre-commit hook

Opening this issue as a placeholder so we don't forget