fix: write default backup to cwd and print saved path

[ivanauth]

Summary

Closes #679.

• zed backup create (with no filename arg) now writes the .zedbackup to the current working directory instead of the directory of the zed binary.
• Both zed backup create and zed backup redact now print Backup written to <abs-path> on stderr after a successful close, so users can see where the file ended up.
• Drive-by: backupRedactCmdFunc switched to a named return (err error) so the existing defer CloseAndJoin(&err, ...) calls actually propagate close errors to the caller (they were previously mutating a shadowed local).

[codecov-commenter]

Codecov Report

❌ Patch coverage is 35.29412% with 22 lines in your changes missing coverage. Please review.
✅ Project coverage is 43.60%. Comparing base (a27106d) to head (35f6a24).

Files with missing lines	Patch %	Lines
internal/cmd/backup.go	35.29%	19 Missing and 3 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #688      +/-   ##
==========================================
- Coverage   43.67%   43.60%   -0.08%     
==========================================
  Files          38       38              
  Lines        6152     6178      +26     
==========================================
+ Hits         2687     2694       +7     
- Misses       3188     3204      +16     
- Partials      277      280       +3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[miparnisari]

Thank you! Tested locally and works great.

[miparnisari]

TIL. Could you add tests for this? It was introduced in https://github.com/authzed/zed/pull/285/files and I think at some point we broke it, because I get

$ ./zed backup create - --log-level trace
12:13PM DBG configured logging async=false format=auto log_level=trace provider=zerolog
12:13PM TRC context={"APIToken":"super-secret-key","CACert":null,"Endpoint":"localhost:50051","HostnameOverride":"","Insecure":true,"Name":"local","NoVerifyCA":false} context-override-via-cli=false
12:13PM WRN not calling a released version of SpiceDB version=97811cf1455d-dirty
12:13PM TRC parsed trailers trailers={"io.spicedb.debug.version":["97811cf1455d-dirty"],"io.spicedb.respmeta.cachedoperationscount":["0"],"io.spicedb.respmeta.dispatchedoperationscount":["1"],"x-request-id":["7ac1f5c6-92b2-42b2-926f-ae5192c9dd38"]}
12:13PM DBG extracted response dispatch metadata cached=0 dispatch=1
// ommitted for brevity

412:13PM ERR terminated with errors error="failed to store cursor in lockfile: cannot create temp file: open /dev/stdout.lock343325193: operation not permitted\nsync /dev/stdout: inappropriate ioctl for device"