The old pre-flight truncated the output at startup with -f, so an
interrupted capture lost the trace, and the probe fopen followed a
symlink. The existing file is now moved to FILE~ for the duration of
the capture and restored if the trace cannot be written.
