v0.4.6 feedback: atomic report replacement in CI

[CAOShurong]

VulnFuse v0.4.6 is available from the GitHub release.

The CLI and GitHub Action now share one report-output path: write a unique temporary sibling, flush it, and rename it over the destination only after the write succeeds. The regression test runs the real bundled Action, injects a failure after 17 bytes, and verifies that an existing complete report remains unchanged and the temporary file is removed.

The evidence and review trail are in issue #18 and PR #19. The public release includes checksums, Apache-2.0 license files in the packages, and a CycloneDX SBOM.

This change does not promise power-loss durability or atomic replacement on every network or unusual filesystem. A hard process or host termination can leave a .vulnfuse-*.tmp sibling because process-level cleanup cannot run. It also does not make downstream artifact uploads validate report syntax.

Useful feedback from real CI workflows would include:

• runner OS, Node version, and filesystem type, especially network-backed workspaces;
• whether the output replaced an existing report;
• what interrupted or failed the step;
• whether a temporary sibling remained; and
• a sanitized workflow fragment showing any later artifact or SARIF upload step.

Please remove sensitive paths and vulnerability evidence before posting logs. Bugs belong in Issues; broader CI reliability feedback is welcome here.