sftp: remove the partially written temp file if writing it fails

[ThomasWaldmann]

store() writes to a temp file and then renames it to the final name. If writing that temp file failed (e.g. the server ran out of space, or an I/O error), the partially written *.tmp file was left behind on the server: invisible to list() (TMP_SUFFIX), never removed, occupying space. Only a failing rename was cleaned up, not a failing write.

Now the temp file is removed on any failure of the write or the rename. The cleanup is best effort: if the unlink itself fails (e.g. the file was never created, or the connection is gone), the original exception is kept, which is the more interesting one and lets with_reconnect still do its job.

Tests use a fake paramiko client (like the existing test_sftp_store_memoryview_gives_bytes_to_paramiko), so they need no real server:

• write fails (both in write and, for pipelined writes, at close time) → the temp file that was opened gets unlinked;
• rename fails → the temp file gets unlinked (this already worked, kept as a regression guard);
• if the cleanup unlink itself fails, the original write error still propagates.

The two write-failure tests fail on main and pass with this change.

Note: if the connection is lost mid-write, the temp file cannot be removed over the dead connection and, since store() is retried from scratch with a fresh temp name, that one temp file may be orphaned on the server. That pre-existing limitation (sftp-only, due to reconnect) is not addressed here.

🤖 Generated with Claude Code