Plain POSIX files: remove commit on close (fs.rs)

Staging every write until close broke tempfile, git, and SQLite, which
expect normal files. Actors that need an atomic publish write a temporary
file and rename it; the SDK has write_atomic for that.

PROTOCOL.md

@@ -71,10 +71,9 @@ Each instance sees three folders:
 (installed version, running, subscriptions), `source/`, `public/`, `data/`,
 `stderr.log`, and `versions/<n>/`. `ls /actor` lists all actors.
 
-A new or truncated file becomes visible when the writer closes it. Before
-that, readers see the old file or no file. If the instance crashes, the write
-is lost. A write to an existing file without truncate (append, edit) goes in
-place.
+Files are plain POSIX files: a write is visible at once. To publish a file
+so that readers never see half of it, write a temporary file and `rename` it
+(the Rust SDK has `write_atomic`).
 
 Send large or binary data as a path under `/actor/<id>/public/`, not inside a
 message.