image_writer: don't destroy unless create succeeds

`cinfo_created` also has to be `volatile` since it's value changes
between the setjmp and longjmp call.

ref: https://www.man7.org/linux/man-pages/man3/setjmp.3.html#CAVEATS