age -o follows a symlink and writes a pipe or device directly (closes #59)

age encrypt -o and age decrypt -o always renamed a new file over the
named path, which replaced a symlink, a named pipe or a device such as
/dev/null with a regular file and made -o /dev/stdout fail. The path is
now looked at without following a final symlink: a missing path or a
regular file is replaced by rename as before, a symlink gets the same
treatment for what it points at, and anything else is written to
directly, without catching signals. A symlink that points at nothing is
refused. -o /dev/stdout and -o /dev/stderr write to the tool's own
streams, so a file they are redirected to is never replaced. The README
says so, and that a replaced file has mode 0600.

Model: opus-5-5

internal/cli/age_test.go

@@ -170,6 +170,7 @@ func TestDevStdoutAddsToTheFileStandardOutputIsAppendedTo(t *testing.T) {
 	command := exec.CommandContext(
 		t.Context(), os.Args[0], "age", "decrypt", "-o", "/dev/stdout", sealed,
 	)
+
 	command.Env = append(os.Environ(), runAsTool+"=1")
 	command.Stdout = appended