fix(cli): prevent temp fd leak and align merge-policy docs

Author: RbBtSn0w

src/specify_cli/__init__.py

@@ -668,13 +668,17 @@ def log(message, color="green"):
 
     def atomic_write_json(target_file: Path, payload: dict[str, Any]) -> None:
         """Atomically write JSON while preserving existing mode bits when possible."""
-        fd, temp_path = tempfile.mkstemp(
-            dir=target_file.parent,
-            prefix=f"{target_file.name}.",
-            suffix=".tmp",
-        )
+        temp_path: Optional[Path] = None
         try:
-            with os.fdopen(fd, 'w', encoding='utf-8') as f:
+            with tempfile.NamedTemporaryFile(
+                mode='w',
+                encoding='utf-8',
+                dir=target_file.parent,
+                prefix=f"{target_file.name}.",
+                suffix=".tmp",
+                delete=False,
+            ) as f:
+                temp_path = Path(f.name)
                 json.dump(payload, f, indent=4)
                 f.write('\n')
 
@@ -694,8 +698,8 @@ def atomic_write_json(target_file: Path, payload: dict[str, Any]) -> None:
 
             os.replace(temp_path, target_file)
         except Exception:
-            if os.path.exists(temp_path):
-                os.unlink(temp_path)
+            if temp_path and temp_path.exists():
+                temp_path.unlink()
             raise
 
     try:
@@ -726,8 +730,8 @@ def merge_json_files(existing_path: Path, new_content: Any, verbose: bool = Fals
 
     Performs a polite deep merge where:
     - New keys are added
-    - Existing keys are PRESERVED (not overwritten) unless they are dictionaries
-    - Nested dictionaries are merged recursively
+    - Existing keys are preserved (not overwritten) unless both values are dictionaries
+    - Nested dictionaries are merged recursively only when both sides are dictionaries
     - Lists and other values are preserved from base if they exist
 
     Args:
@@ -783,8 +787,8 @@ def deep_merge_polite(base: dict[str, Any], update: dict[str, Any]) -> dict[str,
                 # Recursively merge nested dictionaries
                 result[key] = deep_merge_polite(result[key], value)
             else:
-                # Key already exists and is not a dict, PRESERVE existing value
-                # This ensures user settings aren't overwritten by template defaults
+                # Key already exists and values are not both dicts; preserve existing value.
+                # This ensures user settings aren't overwritten by template defaults.
                 pass
         return result