fix: fstab write fails on bind-mounted /host-fstab (EBUSY)

rename() fails with EBUSY on Docker bind-mounted files. Add safeWriteFile()
helper that tries atomic rename first, falls back to direct write. Fixes
both init wizard and attach wizard fstab operations.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/internal/storage/attach_linux.go

@@ -359,15 +359,7 @@ func appendBindFstabEntry(fstabPath, source, target string) error {
 	entry := fmt.Sprintf("\n# Bind mount (auto-generated by felhom-controller)\n%s\t%s\tnone\tbind,nofail\t0 0\n", source, target)
 	newContent := append(existing, []byte(entry)...)
 
-	tmpPath := fstabPath + ".tmp"
-	if err := os.WriteFile(tmpPath, newContent, 0644); err != nil {
-		return fmt.Errorf("cannot write fstab tmp file: %w", err)
-	}
-	if err := os.Rename(tmpPath, fstabPath); err != nil {
-		os.Remove(tmpPath)
-		return fmt.Errorf("cannot rename fstab tmp file: %w", err)
-	}
-	return nil
+	return safeWriteFile(fstabPath, newContent, 0644)
 }
 
 // removeBindFstabEntry removes the bind mount fstab entry for the given target mount path.
@@ -395,14 +387,5 @@ func removeBindFstabEntry(fstabPath, targetMountPath string) error {
 		kept = append(kept, line)
 	}
 
-	newContent := strings.Join(kept, "\n")
-	tmpPath := fstabPath + ".tmp"
-	if err := os.WriteFile(tmpPath, []byte(newContent), 0644); err != nil {
-		return fmt.Errorf("cannot write fstab tmp file: %w", err)
-	}
-	if err := os.Rename(tmpPath, fstabPath); err != nil {
-		os.Remove(tmpPath)
-		return fmt.Errorf("cannot rename fstab tmp file: %w", err)
-	}
-	return nil
+	return safeWriteFile(fstabPath, []byte(strings.Join(kept, "\n")), 0644)
 }