ffmpeg's -y truncates its target immediately, so encoding straight into
the user-chosen path meant a failed or cancelled export (whose cleanup
deletes that path) destroyed any video the user had chosen to overwrite.
Encode into <output>.icarus-partial.mp4 next to the destination and only
rename it over the selected path after a successful encode; failure and
cancellation cleanup now delete only the partial file.