fix: restrict credential-bearing config files to owner access

[hetaoBackend]

Change

Fixes #159. Adding a BYOK provider to an existing 0644 config previously preserved group/other readability, including in atomic temporary files. Other settings writers, config copies and migration backups could retain the same exposure.

• Write credential-bearing configs and their temporary copies with 0600; restrict existing files before writing secret-bearing content. Preserve existing lock/rename behavior and avoid deleting temporary files not created by the current operation.
• On POSIX reads, remove group/other access while preserving owner permissions. Already-private files, including 0400 and immutable 0600 files, are loaded without chmod. An unsafe main config that cannot be restricted still fails to load.
• Repair older BYOK migration backups independently. Inspection/repair failures warn with the affected directory or file and manual action, without blocking a usable main config or leaking arbitrary error messages. Remaining backups are still processed; failed repairs are not reported as successful.
• Read runtime config before starting authentication watchers. This prevents a permission failure during startup from leaving the CLI alive after printing an error.
• Document plaintext storage, read-only behavior, backup warnings and the Windows ACL boundary.

The Windows worker/startup-budget changes have been removed from this PR and are independently reviewable in #181. The smoke-test changes here only exercise config-permission behavior. A merge-tree check confirms the two branches currently combine without conflicts.

Validation

• PASS: complete pnpm verify full profile on clean committed HEAD 9ce8e562a0a0d731e8449a59a12562f895ae846a (macOS arm64, Node 26.4.0): 14/14 gates.
• PASS: 33 focused permission tests, including read-only/private files, removal of non-owner access without granting owner writes, main-config permission failure, backup inspection/repair failures and warning redaction.
• PASS: built CLI smoke acceptance with real macOS immutable files: private config/backup load successfully; unrepairable public backup warns and leaves config usable; unrepairable public main config exits with code 1 instead of hanging. Outbound network is denied by the offline fixture.
• NOT RUN locally: native Linux/Windows acceptance, the wider Node compatibility matrix, read-only mounts, or live-provider calls. macOS immutable-file cases are skipped on other platforms; POSIX mode assertions are skipped on Windows. Windows modes do not implement an owner-only ACL.
• GitHub CI results must be read for the new HEAD; previous green checks on 79a69b8 do not validate this revision. Windows validation policy is separate in test: bound Windows test concurrency and runtime startup #181.

Publication and contribution checks

• Permission to contribute under the existing applicable licenses; existing notices are preserved.
• No credentials, account data, real user content, internal source history or private review material is included. Tests use synthetic data and temporary directories.
• The new private-file helper and permission test are registered in the source inventory; the test is declared in test/vitest-suites.json. This follow-up adds no further files.
• English usage documentation is updated; offline results are not described as live-service acceptance.

Maintainer handoff

Publication scope and licenses are unchanged. Shared-source port: pending maintainer coordination after public review. No automatic merge, issue closure or release.