Write encrypt and decrypt output only once they succeed (closes #143)

`secret encrypt` and `secret decrypt` emptied the file named by
`--output` before reading any input, so a failure left it empty, and a
file given as both `--input` and `--output` was emptied before it was
read. They now write into a temporary file of mode 0600 next to it, or
next to the file it is a symbolic link to, and rename that over it only
on success, using the new `secret.WriteFileAtomicFunc`, which
`secret.WriteFileAtomic` now calls. Ctrl-C or SIGTERM removes the
temporary file. A device or pipe given as `--output`, such as
`/dev/null`, is written to directly.

Judgement call: the device and pipe case goes beyond the plan.
Judgement call: a link to a file that does not exist yet is replaced.

Model: opus-5-5

internal/cli/root.go

@@ -19,6 +19,8 @@ func Entry() int {
 	// off until the read finishes, so a signal there would leave echo off.
 	// Only a process in the terminal's foreground process group may reset
 	// it: one in the background that tries is stopped instead of exiting.
+	// The function also removes the temporary file that encrypt or decrypt
+	// is writing.
 	terminalState, terminalErr := term.GetState(unix.Stdin)
 
 	memguard.CatchSignal(func(os.Signal) {
@@ -26,6 +28,11 @@ func Entry() int {
 		if terminalErr == nil && err == nil && foreground == unix.Getpgrp() {
 			_ = term.Restore(unix.Stdin, terminalState)
 		}
+
+		name := temporaryOutput.Load()
+		if name != nil {
+			_ = os.Remove(*name)
+		}
 	}, os.Interrupt, unix.SIGTERM)
 
 	defer memguard.Purge()