Refactor file handing for self-update.

* Write new file payload to a temp file before touching the original
binary. Minimizes the possibility of failing mid-write and corrupting
the binary.
* On Windows, move the original binary out to a temp file rather than
removing it as the running binary is locked. Fixes issue #2248.

internal/selfupdate/download_windows.go

@@ -0,0 +1,23 @@
+//go:build windows
+// +build windows
+
+package selfupdate
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+// Rename (rather than remove) the running version. The running binary will be locked
+// on Windows and cannot be removed while still executing.
+func removeResticBinary(dir, target string) error {
+	backup := filepath.Join(dir, filepath.Base(target)+".bak")
+	if _, err := os.Stat(backup); err == nil {
+		_ = os.Remove(backup)
+	}
+	if err := os.Rename(target, backup); err != nil {
+		return fmt.Errorf("unable to rename target file: %v", err)
+	}
+	return nil
+}