Write encrypt and decrypt output only once they succeed (closes #143)

`secret encrypt` and `secret decrypt` emptied the file named by
`--output` before reading any input, so a failure left it empty, and a
file given as both `--input` and `--output` was emptied before it was
read. They now write into a temporary file of mode 0600 next to it, or
next to the file it is a symbolic link to, and rename that over it only
on success, with the new `secret.WriteFileAtomicFunc`. An output file
that cannot be written still fails. Ctrl-C, SIGTERM or a hangup removes
the temporary file. A device or pipe, such as `/dev/null`, is written to
directly.

Judgement calls: the device and pipe case; a command started with
`nohup` still ignores a hangup.

Model: opus-5-5

TODO.md

@@ -18,6 +18,18 @@ https://git.eeqj.de/sneak/secret/milestone/12
 
 # Completed Steps
 
+- 2026-10-14: A failed `secret encrypt` or `secret decrypt` leaves the file
+  named by `--output` as it was, and the same file can be given as `--input` and
+  `--output` (https://git.eeqj.de/sneak/secret/issues/143). Both emptied the
+  output file before reading any input, so a wrong key left it empty, and a file
+  given as both was emptied before it was read. They now write the result into a
+  temporary file next to it, or next to the file it is a symbolic link to, and
+  rename that over it once they have succeeded, with the new
+  `secret.WriteFileAtomicFunc`, which `secret.WriteFileAtomic` now calls; the
+  output file has mode 0600. An output file that cannot be written still fails
+  the command. Ctrl-C, SIGTERM or a hangup removes the temporary file, and a
+  command started with `nohup` still ignores a hangup. A device or a pipe given
+  as `--output`, such as `/dev/null`, is still written to directly.
 - 2026-10-14: A wrong passphrase, from `SB_UNLOCK_PASSPHRASE` or typed at the
   prompt, gives the error `wrong passphrase for unlocker <id>`
   (https://git.eeqj.de/sneak/secret/issues/157). It used to be age's "no