4e520f9c0c
Wrap the WriteAllBytes/Move/HardenPermissions sequence in a try/catch so that any failure best-effort deletes the hardened .tmp file (which may already hold PFX/private-key bytes) before rethrowing. Add a test that induces a persist failure by pointing SelfSignedCertPath inside a regular file and asserts no .tmp is left on disk.