publishing

Build dest through a staging file, then rename it into place.

The staging path is in dest's own directory — a cross-filesystem move is a full copy, and these are the largest files this mod writes — and unique per call, so two instances over one game dir race only on the rename, which is atomic. On POSIX createTempFile also makes it owner-only and the rename keeps that mode, which is what the token file's permissions rest on.

The two flushes are what carry that across a CRASH rather than only across a concurrent reader: ATOMIC_MOVE orders the swap, it does not commit the bytes. Worst case is the config file, which ConfigFile refuses to regenerate over once it fails to read — so a torn one is permanent.