Previously, if .hg/store/00manifest.d.hgtmp1 exists, hg will copy the
entire 00manifest.d every time when appending new manifest revisions.
That could happen if Mercurial or the machine crashed when .hgtmp1 was
just created but not deleted yet.
This patch changes the fixed name to a random generated name. To be
consistent with D468, ~ suffix was used.
mkstemp() may raise OSError, which should be caught as before.