Implement atomic save

Ping @fperez, this should avoid issues with corrupted/lost notebooks when the disk is full, though I haven't worked out how to test it just yet.

Closes gh-6254
Thanks, but pywin32 is not a dependency. I don't think that's worth
worrying about.