Fix the five resilience review findings

internal/core/diagnostics/output_session.go

@@ -50,7 +50,7 @@ type OutputSession struct {
 func PrepareOutput(selection OutputSelection) (*OutputSession, error) {
 	session := &OutputSession{enabled: selection.ReportingEnabled, replace: atomicReplace}
 	active := make([]string, 0, 4)
-	if strings.TrimSpace(selection.TranscriptPath) != "" {
+	if selection.TranscriptPath != "" {
 		session.transcript = selection.TranscriptPath
 		active = append(active, session.transcript)
 	}
@@ -74,7 +74,7 @@ func PrepareOutput(selection OutputSelection) (*OutputSession, error) {
 	}
 	protected := make([]string, 0, len(selection.ProtectedPaths))
 	for _, path := range selection.ProtectedPaths {
-		if strings.TrimSpace(path) != "" {
+		if path != "" {
 			protected = append(protected, path)
 		}
 	}
@@ -251,18 +251,26 @@ func atomicReplace(path string, payload []byte) error {
 	if err != nil {
 		return err
 	}
-	parent := filepath.Dir(publishPath)
-	temp, err := os.CreateTemp(parent, ".audita-write-*")
+	// A private temporary directory lets ordinary file creation apply the umask
+	// without reading or changing process-global state. Rename stays on the same
+	// filesystem, and the incomplete payload is not accessible through the parent.
+	dir, err := os.MkdirTemp(filepath.Dir(publishPath), ".audita-write-*")
 	if err != nil {
 		return err
 	}
-	name := temp.Name()
-	defer os.Remove(name)
-	mode := os.FileMode(0644)
-	if info, err := os.Stat(publishPath); err == nil {
-		mode = info.Mode().Perm()
+	defer os.Remove(dir)
+	name := filepath.Join(dir, "payload")
+	temp, err := os.OpenFile(name, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0644)
+	if err != nil {
+		return err
 	}
-	if err := temp.Chmod(mode); err != nil {
+	defer os.Remove(name)
+	if info, err := os.Stat(publishPath); err == nil {
+		if err := temp.Chmod(info.Mode().Perm()); err != nil {
+			_ = temp.Close()
+			return err
+		}
+	} else if !errors.Is(err, os.ErrNotExist) {
 		_ = temp.Close()
 		return err
 	}