fix(backup): retain staging cleanup capability

tools/tht/internal/safeio/private_root_windows.go

@@ -538,6 +538,41 @@ func (directory *windowsPrivateDirectory) CreateRegular(name string, contents []
 	return true, nil
 }
 
+func (directory *windowsPrivateDirectory) CreateRegularFile(name string) (*os.File, bool, error) {
+	if directory.Validate() != nil || !validPrivateLeafName(name) {
+		return nil, false, ErrUnsafeFile
+	}
+	value, err := createWindowsPrivateRegularAt(directory.handle, name)
+	if err != nil {
+		existing, existingErr := openWindowsPrivateRegularAt(directory.handle, name, windows.FILE_GENERIC_READ, 1)
+		if existingErr == nil {
+			if existing.Close() != nil || directory.Validate() != nil {
+				return nil, false, ErrUnsafeFile
+			}
+			return nil, false, nil
+		}
+		return nil, false, ErrUnsafeFile
+	}
+	failed := true
+	defer func() {
+		if failed {
+			_ = closeAndDeleteWindowsPrivateRegular(value)
+		}
+	}()
+	info, err := privateWindowsRegularInfo(value.handle, 1)
+	if err != nil || directory.Validate() != nil {
+		return nil, false, ErrUnsafeFile
+	}
+	value.info = info
+	file := os.NewFile(uintptr(value.handle), "tht-safeio-private-root-stream")
+	if file == nil {
+		return nil, false, ErrUnsafeFile
+	}
+	value.handle = 0
+	failed = false
+	return file, true, nil
+}
+
 func (directory *windowsPrivateDirectory) ReadRegular(name string, maximum int64) ([]byte, bool, error) {
 	if directory.Validate() != nil || !validPrivateLeafName(name) || maximum < 0 || maximum == int64(^uint64(0)>>1) {
 		return nil, false, ErrUnsafeFile