Automatic release of main @ 625a583

Atomically write downloaded file to filesystem (#3)

This prevents writing a truncated file to a valid cache path, and
serving that partial file later.

This uses a new dependency, github.com/natefinch/atomic, which from a
quick look seems to do the right thing.