`secret encrypt` and `secret decrypt` emptied the file named by
`--output` before reading any input, so a failure left it empty, and a
file given as both `--input` and `--output` was emptied before it was
read. They now write into a temporary file of mode 0600 next to it and
rename that over it only on success, using the new
`secret.WriteFileAtomicFunc`, which `secret.WriteFileAtomic` now calls.
A device or pipe given as `--output`, such as `/dev/null`, is written to
directly instead of being replaced by a file.
Judgement call: the device and pipe case goes beyond the plan.
Judgement call: a symbolic link given as `--output` is replaced, not followed.
Model: opus-5-5
