age -o follows a symlink and writes a pipe or device directly (closes #59)

age encrypt -o and age decrypt -o always renamed a new file over the
named path, replacing a symlink, a named pipe or a device such as
/dev/null with a regular file. A path that is the same file as the
tool's standard output or standard error, under any name, is now
written to that stream, so the file it is redirected to keeps its
contents. Any other path is looked at without following a final
symlink: nothing there or a regular file is replaced by rename as
before, a symlink gets the same treatment for what it points at and is
refused if it points at nothing, and anything else is written to
directly, without catching signals. The README says so, and that a
replaced file has mode 0600.

Model: opus-5-5

internal/cli/cli.go

@@ -85,7 +85,8 @@ func init() {
 // signals to clean up first: "ssh to" and "ssh install" while they
 // have ssh or sftp running, so the child ends and their own cleanup
 // still runs, and "age encrypt -o" and "age decrypt -o" while they
-// write, so the unfinished file is removed.
+// write a new file to rename over the named one, so the unfinished file
+// is removed.
 func Main() int {
 	err := Root().Execute()
 	if err == nil {