Opens path for writing on the condition that nothing already sits there — a pre-existing
file, and a symlink regardless of its target, both fail with AlreadyExists per POSIX
O_CREAT|O_EXCL semantics (on wasm32-wasip1, a symlink leaving the sandbox instead fails
with ENOTCAPABLE — see [is_planted_symlink_refusal]), so the call never writes through a
planted link. A first residue is cleared and the create is retried once; a second refusal —
the residue could not be removed, or the path was claimed again in the instant after clearing
it — surfaces as an AtomicTemporaryFileError wrapped in the returned io::Error (see
AtomicTemporaryFileError::downcast).
Writes contents to target by creating <target>.tmp on exclusive terms (see
open_temporary), fsyncing it, and renaming it over target — the rename is atomic, so a
reader of target never observes a partially written file. Leaves <target>.tmp behind on a
write/fsync failure; the next call clears it as ordinary residue.