dep: Use hidden tempdir for old vendor

While there's more work to be done in making all of this safe in the
event of a signal being sent to dep, this change at least means that if
a signal is sent during the rename and a .vendor.orig directory is left
behind, subsequent runs will treat its contents as ignored.

Fixes #1304

txn_writer.go

@@ -382,7 +382,7 @@ func (sw *SafeWriter) Write(root string, sm gps.SourceManager, examples bool, lo
 			if _, err := os.Stat(vendorbak); err == nil {
 				// If the adjacent dir already exists, bite the bullet and move
 				// to a proper tempdir.
-				vendorbak = filepath.Join(td, "vendor.orig")
+				vendorbak = filepath.Join(td, ".vendor.orig")
 			}
 
 			failerr = fs.RenameWithFallback(vpath, vendorbak)