fix: use atomic write-then-rename for state files

[tylerbutler]

Summary

• Replace non-atomic fs::write calls in state file operations with a write-then-rename pattern using tempfile::NamedTempFile
• Add atomic_write helper function that writes to a temporary file in the same directory then atomically renames it into place
• Promote tempfile from dev-dependency to regular dependency

Closes #237

Details

Three state file write locations were vulnerable to corruption if the process was interrupted mid-write (fs::write truncates then writes):

1. save_overlay_state - in-repo overlay state files
2. save_external_state - external backup state files
3. remove_external_state - marking overlays as removed

The .target_path marker file write in save_external_state is left as fs::write since it's a non-critical debug marker.

Test plan

• All 155 existing tests pass
• Formatting check passes
• No new clippy warnings introduced

[github-actions]

Missing Changelog Entry

This PR includes commits with types that typically require a changelog entry (fix), but no changie fragment was found.

To add one, run:

changie new

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!