Write encrypt and decrypt output only once they succeed (closes #143)

`secret encrypt` and `secret decrypt` emptied the file named by
`--output` before reading any input, so a failure left it empty, and a
file given as both `--input` and `--output` was emptied before it was
read. They now write into a temporary file of mode 0600 next to it, or
next to the path it is a symbolic link to, and rename that over it only
on success, using the new `secret.WriteFileAtomicFunc`, which
`secret.WriteFileAtomic` now calls. Ctrl-C or SIGTERM removes the
temporary file. A device or pipe given as `--output`, such as
`/dev/null`, is written to directly.

Judgement call: the device and pipe case goes beyond the plan.

Model: opus-5-5

TODO.md

@@ -18,6 +18,17 @@ https://git.eeqj.de/sneak/secret/milestone/12
 
 # Completed Steps
 
+- 2026-10-14: A failed `secret encrypt` or `secret decrypt` leaves the file
+  named by `--output` as it was, and the same file can be given as `--input` and
+  `--output` (https://git.eeqj.de/sneak/secret/issues/143). Both emptied the
+  output file before reading any input, so a wrong key left it empty, and a file
+  given as both was emptied before it was read. They now write the result into a
+  temporary file next to it, or next to the file it is a symbolic link to, and
+  rename that over it once they have succeeded, with the new
+  `secret.WriteFileAtomicFunc`, which `secret.WriteFileAtomic` now calls; the
+  output file has mode 0600. Ctrl-C or SIGTERM removes the temporary file. A
+  device or a pipe given as `--output`, such as `/dev/null`, is still written to
+  directly.
 - 2026-10-14: A `secret add --force` that cannot unlock the vault, given a wrong
   passphrase or mnemonic, leaves the secret as it was
   (https://git.eeqj.de/sneak/secret/issues/136). The new version used to be