Docs for the Rust version; benchmarks; build.sh fixes

README, CLAUDE.md, man pages, the user guide and its screenshot script
now describe the Rust build and the intentional behaviour changes, which
docs/MIGRATION.md lists. Go and Rust micro-benchmarks for the same
operations, and scripts/bench.sh for end-to-end comparison. build.sh
exports its tree root to the per-target jobs and keeps logs out of the
output directory; riscv64 musl builds use getrandom's raw syscall
backend, since zig's musl getrandom never reaches the kernel there.

Co-Authored-By: Claude <noreply@anthropic.com>

docs/vault-get.1

@@ -1,4 +1,4 @@
-.TH VAULT-GET 1 "September 2026" "vault" "User Commands"
+.TH VAULT-GET 1 "October 2026" "vault" "User Commands"
 .SH NAME
 vault-get \- decrypt a stored file
 .SH SYNOPSIS
@@ -13,13 +13,18 @@ vault-get \- decrypt a stored file
 .I NAME
 .SH DESCRIPTION
 Decrypts \fINAME\fR. Nothing appears at the output path until every object has
-authenticated. The stored mode and modification time are restored. It refuses
-to overwrite an existing file. Takes a shared lock.
+authenticated, padding and end of file included; until then the output is a
+private temporary file in the same directory, removed on failure. The stored
+mode and modification time are restored. It never replaces anything already
+at the output path, including a symbolic link (even a dangling one) or a
+file created while it runs. Takes a shared lock.
 .PP
 With \fB\-r\fR, \fINAME\fR is a folder, and every file under it is
 decrypted into the output directory, keeping the folder structure. Each file
 is checked as above; a clash stops the run, leaving the files already
-written.
+written. Directories are created as needed, mode 0700; a symbolic link (or
+anything but a directory) where a directory belongs inside the output
+directory stops the run rather than being followed.
 .SH OPTIONS
 .TP
 .BI \-o " OUTPUT"