dnsmasq loads every file in /etc/dnsmasq.d/ (skipping only .dpkg-*).
SafeApply was leaving .bak backup files after successful applies, causing
duplicate/conflicting DNS records. Also moves dnsmasq's validation temp
file to /tmp so a crash can't leave a .validate file in the conf dir.