The file endpoint doesn't delete the file after it unzips it. This, of course, would be correct given an example like this
However, the HTTP endpoint downloads the zip to a file named temp<GUID>.zip and then defers to the file endpoint for processing. Since the file endpoint doesn't have any context around who is calling it, it leaves the zip file.
The canonical form of the install above is actually the following since it uses the File endpoint.
Create a new TempFile endpoint that extends the File endpoint, but deletes the zip when done.
Then modify the HTTP endpoint to defer to the tempFile endpoint instead.