Atomic statefile operations

Added untested code to ensure that Pond statefile writes occur atomically; i.e., writes occur to a temporary file without truncating it. In the event that writing fails, Pond will leave behind the old statefile. Not yet tested; security implications unclear.

Should (hopefully) fix an irritating bug that I've encountered (often in VMs), in which Pond attempts to write out its statefile on close, successfully opens it in truncate mode, and then can't write anything to the truncated file because the VHD is out of space.