import-checker: ensure cffi is always a system module I've had reports that this is not always happening, so whitelist it the way we whitelist other problem cases.

atomictempfile: add context manager support Close the file (moving it in place) on clean context exit, discard when there has been an exception.