Make nix-installer plan invalid-plan fail (#331)

* Make `nix-installer plan invalid-plan` fail

Prior to this change, the `invalid-plan` would unexpectedly be
interpreted as the output path. Now there is a flag to specify where the
plan should be written to.

* use `out-file` and `NIX_INSTALLER_PLAN_OUT_FILE`

src/cli/subcommand/plan.rs

@@ -13,7 +13,12 @@ use crate::cli::CommandExecute;
 pub struct Plan {
     #[clap(subcommand)]
     pub planner: Option<BuiltinPlanner>,
-    #[clap(env = "NIX_INSTALLER_PLAN", default_value = "/dev/stdout")]
+    /// Where to write the generated plan (in JSON format)
+    #[clap(
+        long = "out-file",
+        env = "NIX_INSTALLER_PLAN_OUT_FILE",
+        default_value = "/dev/stdout"
+    )]
     pub output: PathBuf,
 }