At the moment we don't provide a possibility to add state scripts to the cleanup state.
If I understood correctly this apparently for historical reasons not by design decision.
A big ent customer would like to track the number of failed updates on the client side regardless of when it happens.
Currently if the device is reboots during download it that can't be extended by a state script.
Slack conversation: https://northern-tech.slack.com/archives/C2D3HRU9M/p1647438208819239
Zendesk ticket: https://cfengine.zendesk.com/agent/tickets/5528