Hold the encrypt and decrypt result in memory until it is written (closes #143)

With --output, secret encrypt and secret decrypt emptied that file before
reading any input, so a failed command left it empty, and encrypting a file
onto itself gave the encryption of nothing.

With --output they now hold the result in memory and open --output, with the
same call as before, only once encryption or decryption has succeeded. A
failed command leaves --output untouched, and --input can be the same file.
Without --output the result still goes to stdout as it is produced.

Model: opus-5-5

internal/cli/crypto.go

@@ -220,7 +220,7 @@ func (cli *Instance) Encrypt(secretName, inputFile, outputFile string) error {
 		return nil
 	}
 
-	return cli.writeOutputFile(outputFile, result.Bytes())
+	return cli.writeOutputFile(outputFile, &result)
 }
 
 // Decrypt decrypts data using an age secret key stored in a secret
@@ -307,19 +307,21 @@ func (cli *Instance) Decrypt(secretName, inputFile, outputFile string) error {
 		return nil
 	}
 
-	return cli.writeOutputFile(outputFile, result.Bytes())
+	return cli.writeOutputFile(outputFile, &result)
 }
 
 // writeOutputFile creates outputFile, or empties it if it exists, and
 // writes result into it.
-func (cli *Instance) writeOutputFile(outputFile string, result []byte) error {
+func (cli *Instance) writeOutputFile(
+	outputFile string, result *bytes.Buffer,
+) error {
 	file, err := cli.fs.Create(outputFile)
 	if err != nil {
 		return fmt.Errorf("failed to create output file: %w", err)
 	}
 	defer func() { _ = file.Close() }()
 
-	_, err = file.Write(result)
+	_, err = result.WriteTo(file)
 	if err != nil {
 		return fmt.Errorf("failed to write output file: %w", err)
 	}