Extract kb's duplicated atomic-write sequence into a single helper

[williamthorsen]

Problem

writeNote (note-io/write-note.ts) and writeAtomic (taxonomy/write-taxonomy.ts) hold
byte-identical temp-file-plus-rename sequences: a randomBytes(8) suffix, writeFile, rename,
unlink-on-failure, rethrow. Neither copy is reachable from the other, so a change to the atomic-write
contract has to be made twice and can be made once by mistake.

Context

#1261 changed the failure-cleanup shape in both copies, making the identical edit in each.

filesystem/ already holds kb's filesystem primitives and is a published entry point
(@williamthorsen/kb/filesystem), so a module placed there reaches the public surface only if the
barrel re-exports it.

Proposed solution

One internal writeAtomic module under filesystem/, consumed by both call sites. writeNote keeps
rendering the note and delegates the write.

Acceptance criteria

Must have

• kb spells the temp-file-plus-rename sequence once, and both writeNote and writeTaxonomy reach it.
• The helper is internal: filesystem/index.ts does not re-export it.
• The helper has a __tests__ sibling covering the rename-failure cleanup, including that the
  rename error reaches the caller when the cleanup itself fails.
• Both call sites keep their current observable behavior, still covered by their existing suites.