Use temp file to save metadata for readonly file

Unfortunately this is dangerous, I believe. WithExtension returns a TempFile, an object meant to be disposed. Since we neither retain nor dispose it, it will be garbage-collected at an unpredictable time. For now, we will get away with this, because TempFile is a very unusual Disposable object which lacks a destructor to perform the Dispose() behavior when someone forgets to dispose it. However, if someone changes (fixes?) that one day, our temp file will start disappearing at an unpredictable moment, probably producing difficult, unreproducible bugs.
You are right, though, that it is nicer not to create and then delete the file. How about adding a method to TempFile, DisposeWithoutDeleting()? This would clear the Path (so if by any chance it later gets disposed, the file does not get deleted...this requires a new check in the main Dispose).
This is somewhat nasty, since it clutters the temp folder with permanent temporary files. But that's the price of our solution to this problem. Conceivably, Bloom could check whether the image file it gets back is in the temp folder and delete it if it is (after copying). The comment on the new method could well include a warning.
Another option is to change the API and have the method that asks for the image return an optional argument of type TempFile. If a TempFile is returned, the client is responsible to Dispose() it once done with the temp file. I don't like this much because one day we may come up with a better solution that doesn't involve temp files at all.