fix(credentials): guard fchmod on Windows

[OllieinCanada]

Fixes #1868

Summary

Guard the POSIX-only os.fchmod call when atomically writing credentials so
OAuth token refreshes can persist rotated credentials on Windows.

The write path still applies mode 0600 whenever fchmod is available. On
platforms without it, the existing atomic write, file fsync, and replacement
continue normally.

Impact

Previously, the refresh request could succeed and rotate the server-side
refresh token, then Windows would raise AttributeError before writing the new
token. The credentials file retained the now-invalid old token and subsequent
refreshes failed with invalid_grant.

Tests

• deterministic regression with os.fchmod removed
• security regression proving available fchmod is called with 0600
• existing end-to-end mocked refresh/write-back test
• tests/lib/test_credentials.py: 219 passed, 4 skipped
• ruff check .
• targeted Ruff format, Pyright, and Mypy checks
• dependency-cap validation and import smoke test
• git diff --check

No real credentials, API calls, or external services are used by the
regression tests.