The backup copied whatever file sat at the catalog path after decryption
failed, so a concurrent save could be backed up under the original's name
and the original lost. Write the document that failed to decrypt instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>