chore: merge tempfile functions

[Cedric / ViaDézo1er (viadezo1er)]

We were both using the tempfile crate and reinventing what it does.
The reinvention has been removed. They were the only place where windows-sys was directly called, thus the Cargo.toml change.

AI summary:

The changes consolidate file-writing logic around shared atomic-write helpers in src/utils/fs_atomic.rs.

Main behavior changes

• Adds shared helpers:
  • write_json_atomic
  • write_json_atomic_private
  • Existing write_text_atomic / write_bytes_atomic now use the same implementation.
• Writes now:
  1. Create missing parent directories.
  2. Create a uniquely named temporary file in the destination directory.
  3. Write the full contents.
  4. Atomically persist/rename it over the destination.
• JSON output is pretty-printed and ends with a newline.
• Private JSON files use Unix permissions 0600; normal files use 0644.

Call sites migrated

The shared helpers now write:

• Auth config and secret stores (src/auth.rs)
• AI provider warning state
• Global/project config (src/config/mod.rs)
• Dataset/sync JSON artifacts
• Setup-generated JSON, TOML, and text files (src/setup/mod.rs)

This removes several duplicated implementations that used fixed .tmp filenames or direct writes. Setup text files, previously written directly, are now atomic too.

Platform/dependency changes

• Removes the Windows-specific ReplaceFileW implementation.
• Removes the direct windows-sys dependency.
• Uses tempfile::NamedTempFile::persist on all platforms instead.

Tests

Tests now cover:

• Creation of nested parent directories.
• Overwriting existing files.
• Tightening private JSON file permissions to 0600.

One notable semantic difference is that the new common writer no longer explicitly calls sync_all() before persisting, unlike some of the
previous implementations. It protects against partial-file visibility, but provides weaker guarantees against sudden power loss.

[github-actions]

Latest downloadable build artifacts for this PR commit bfc6b55f5633:

• Workflow run: https://github.com/braintrustdata/bt/actions/runs/31749859143
• Download all artifacts (GitHub CLI): gh run download 31749859143 --repo braintrustdata/bt
• Installers are published from main automatically. To publish one for a PR branch, run release-canary manually via workflow_dispatch.

Available artifact names

• artifacts-build-global
• artifacts-build-local-x86_64-apple-darwin
• artifacts-build-local-aarch64-pc-windows-msvc
• artifacts-build-local-x86_64-pc-windows-msvc
• artifacts-build-local-x86_64-unknown-linux-musl
• artifacts-build-local-x86_64-unknown-linux-gnu
• artifacts-build-local-aarch64-apple-darwin
• artifacts-build-local-aarch64-unknown-linux-gnu
• artifacts-plan-dist-manifest
• cargo-dist-cache