Hold the encrypt and decrypt result in memory until it is written (closes #143)

With --output, secret encrypt and secret decrypt emptied that file before
reading any input, so a failed command left it empty, and encrypting a file
onto itself gave the encryption of nothing.

With --output they now hold the result in memory and open --output, with the
same call as before, only once encryption or decryption has succeeded. A
failed command leaves --output untouched, and --input can be the same file.
Without --output the result still goes to stdout as it is produced.

Model: opus-5-5

internal/cli/version.go

@@ -64,7 +64,7 @@ func VersionCommands(cli *Instance) *cobra.Command {
 	promoteCmd := &cobra.Command{
 		Use:   "promote <secret-name> <version>",
 		Short: "Promote a specific version to current",
-		Long: "Rewrites the secret's current file to name the specified " +
+		Long: "Updates the current symlink to point to the specified " +
 			"version. The versions' own times are left unchanged; secret " +
 			"list then gives the time of the promote as the secret's last " +
 			"update.",
@@ -293,7 +293,7 @@ func (cli *Instance) PromoteVersion(
 			version, vault.ErrVersionNotFound, secretName)
 	}
 
-	// Rewrite the secret's current file to name the version
+	// Update the current symlink using the proper function
 	err = secret.SetCurrentVersion(cli.fs, secretDir, version)
 	if err != nil {
 		return fmt.Errorf("failed to update current version: %w", err)

internal/cli/version_test.go

@@ -6,8 +6,6 @@
 // - TestListVersionsNonExistentSecret: Tests error handling for missing secrets
 // - TestPromoteVersionCommand: Tests `secret version promote` command
 // - TestPromoteNonExistentVersion: Tests error handling for invalid promotion
-// - TestPromoteHelpSaysCurrentFileIsRewritten: Tests `secret version promote
-//   --help` text
 // - TestGetSecretWithVersion: Tests `secret get --version` flag functionality
 // - TestGetSecretWritesBinaryValue: Tests `secret get` output of binary values
 // - TestGetSecretReturnsWriteError: Tests `secret get` when stdout fails
@@ -272,23 +270,6 @@ func TestPromoteNonExistentVersion(t *testing.T) {
 	require.ErrorIs(t, err, vault.ErrVersionNotFound)
 }
 
-// TestPromoteHelpSaysCurrentFileIsRewritten is a regression test for
-// https://git.eeqj.de/sneak/secret/issues/153: `secret version promote
-// --help` said it updates a symlink, but promote rewrites the secret's
-// `current` file, which is a plain file.
-//
-//nolint:paralleltest // executes the CLI in-process and sets the environment
-func TestPromoteHelpSaysCurrentFileIsRewritten(t *testing.T) {
-	env := map[string]string{secret.EnvStateDir: t.TempDir()}
-
-	output, err := ExecuteCommandInProcess(
-		[]string{"version", "promote", "--help"}, "", env)
-	require.NoError(t, err)
-
-	assert.NotContains(t, output, "symlink")
-	assert.Contains(t, output, "current file")
-}
-
 func TestGetSecretWithVersion(t *testing.T) {
 	t.Parallel()