[9.4](backport #51791) make creation of meta.json file atomic

[mergify]

Proposed commit message

filebeat/registrar/migrate.go contains two places that write meta.json during registry migration. The final step of updateToVersion1 used os.WriteFile, which truncates the target file to zero bytes on open before writing the new content. If Filebeat was killed (OOM, SIGKILL) in the window between that truncation and the write completing, meta.json was left empty.

On every subsequent restart, readVersion finds the empty file, json.Unmarshal fails with "unexpected end of JSON input", and Filebeat refuses to start. The error is permanent until the file is manually removed.

safeWriteFile (used by updateToVersion0) had the same structural risk: it opened with O_TRUNC and wrote in-place, with no atomic handoff.

Changes

safeWriteFile rewritten to use a temp-file + atomic rename pattern:

• os.CreateTemp creates a new file in the same directory as the target (same filesystem, so rename is always atomic)
• Permissions are set via f.Chmod (fd-based, no TOCTOU race) before rename
• f.Sync + f.Close flush the data durably before the rename
• helper.SafeFileRotate (which wraps os.Rename + parent-dir fsync) atomically replaces the target
• A deferred closure always calls f.Close then os.Remove on the temp file; on success the remove is a no-op (file was renamed away)

The target file's previous content is never destroyed until the new content is fully written and synced. A kill at any point leaves either the old file intact or the complete new file in place — never an empty file.

updateToVersion1 updated to call safeWriteFile instead of os.WriteFile for the final {"version": "1"} write, giving it the same crash-safety guarantee as the version-0 path.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
• I have added an entry in ./changelog/fragments using the changelog tool.

Disruptive User Impact

None.

How to test this PR locally

go test ./filebeat/registrar/ -run TestSafeWriteFile -v

Related issues

Use cases

Screenshots

Logs

---

This is an automatic backport of pull request #51791 done by [Mergify](https://mergify.com).

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)
• /test : Run the Buildkite pipeline.

[infra-vault-gh-plugin-prod]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request