fs/local: make Write atomic, preserve target mode, honor ctx

[srerickson]

Write opened the destination with O_CREATE|O_TRUNC and copied into it at a
hardcoded 0644. Three defects followed: a failed or canceled copy left the
target truncated or partial with the previous complete file gone; overwriting
a 0600 file silently published it at 0644; and io.Copy never consulted ctx, so
a canceled write kept running.

Write now copies to a unique temp file ("..tmp-",
O_CREATE|O_EXCL|O_WRONLY) in the target's own directory, syncs it, closes it,
and renames it over the target. A reader of the target sees the old file or
the new file in full, never a partial one; every path before the rename
removes the temp file, so failures leave no litter. The containing directory
is fsynced best-effort afterwards so the rename itself survives a crash.

The target's mode is carried onto the replacement with chmod (not umask-
masked, so the mode is copied exactly), but only when Lstat reports a regular
file: for a symlink neither mode on hand describes the file being created —
the referent's belongs to a file that is not being written, and the link's own
is 0777 on POSIX, which would publish a world-writable file. IsRegular rejects
both, plus directories and devices. An explicit havePerm bool, rather than a
preserveMode != 0 sentinel, keeps a target legitimately at 0000 from being
widened to the default. A new file gets 0666 subject to umask, matching
os.Create, in place of the hardcoded 0644.

The copy runs through ctxReader, which checks ctx before each read and
deliberately exposes only Read: *strings.Reader, *bytes.Reader and *os.File
implement io.WriterTo, which io.Copy consults first, so forwarding it would
hand the copy a fast path that never checks the context. A copy that stops
because the context ended reports the context error, so callers can match
context.Canceled and context.DeadlineExceeded.

The rename goes through robustio.Rename rather than a hand-written Windows
helper. os.Rename on Windows has been MoveFileEx(MOVEFILE_REPLACE_EXISTING)
with fixLongPath applied since Go 1.16, so a MoveFileEx helper would only
duplicate it minus long-path handling and degrade to a non-atomic
Remove+Rename fallback. The real Windows hazard is a scanner or indexer
holding a transient handle on the just-closed temp file; robustio retries
those errors with bounded backoff and keeps the atomic replace. On Linux it is
a plain passthrough to os.Rename. Cost is one go.mod line and no transitive
modules, and golang.org/x/sys stays indirect.

The temp name is capped at NAME_MAX with the cut backed off to a UTF-8 rune
boundary, since long multibyte OCFL content names would otherwise produce an
invalid name that strict filesystems reject.

Any failure before the rename now returns 0 bytes written: nothing reached the
target, so reporting the bytes that reached the temp file would describe a
file that does not exist.

Closes item 1 of #164 as a side effect: Write never opens the target path, so
a symlink at name has its link entry replaced rather than being written
through to its referent.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_0174A5w1tx7rA1BRUgeLpfb7