Use a temporary file when receiving `head.db`

During catchup, `head.db` was overwritten in-place, which is rather
unsafe at several levels.

This commit changes the receiving mechanism to use a temporary file, and
safely rename the received file (if successful) to the target `head.db`.