state: Save syncs the state file before renaming it into place (closes #264)

Save wrote state.json.tmp with os.WriteFile and renamed it over
state.json without syncing. After a power loss the rename could reach
the disk before the data, leaving an empty state.json that Load cannot
parse, so every start failed.

Save now writes the temp file through its own handle, syncs and closes
it, renames it, then syncs the data directory so the rename is on disk
too. The new test starts from a leftover temp file longer than the
state; a test cannot observe the syncs, which are confirmed by reading.

Rule suppressed: gosec's file-path warning on the temp file's open, as
Load already does.

Model: opus-5-5

TODO.md

@@ -19,6 +19,8 @@ trial run of the finished image: https://git.eeqj.de/sneak/dnswatcher/issues/149
 
 # Completed Steps
 
+- 2026-10-13: a save syncs the state file to disk before renaming it into place,
+  so a crash cannot leave it empty and stop the next start (closes #264).
 - 2026-10-13: a `PORT` that cannot be bound stops startup with an error naming
   the address, instead of running without the HTTP server (closes #266).
 - 2026-10-13: a bad `PORT`, `DNSWATCHER_TLS_EXPIRY_WARNING` or true/false