Function write_vault 

pub fn write_vault(
    path: &Path,
    header: &VaultHeader,
    secrets: &[Secret],
    hmac_key: &[u8],
) -> Result<()>

Write a vault file to disk atomically.

1. Serialize header and secrets to JSON.
2. Compute HMAC over header + secrets bytes.
3. Write to a temp file in the same directory.
4. Rename temp file over the target path.

The rename ensures readers never see a half-written file.