fix(core): restrict session artifact permissions on unix (light-tested)

[1688mengdie]

Summary

On unix, session JSON artifacts written through JsonFileStore (session
transcripts, metadata, token usage) were published with permissions
inherited from the process umask — typically 0o644 — making prompt and
output content world-readable on multi-user hosts.

This PR tightens the temporary artifact file to owner-only (previous
mode masked with 0o700) before it is renamed into place, so the
published artifact ends up 0o600-equivalent regardless of the process
umask. Permission tightening is best-effort: failures to read or set the
permissions are logged and the write still succeeds. Windows behavior is
unchanged (the tightening block is compiled out on non-unix targets).

Fixes #2605

Type and Areas

Type: security fix

Areas: Agent runtime / core

Verification

• cargo check --locked -p bitfun-services-core --jobs 4 — passed (0 errors, 0 warnings).
• cargo test --locked -p bitfun-services-core --features local-storage --test storage_owner_contracts --jobs 4 — 11 passed, 0 failed (same count before and after the change: zero regression).
• Unix behavior note: this development host runs Windows, so the 0o600 publication path could not be exercised locally; the CI ubuntu/macos matrix is the verification source for the unix-only code path (the change is #[cfg(unix)]-gated and compiles out on Windows).

Reviewer Notes

• The change is a pure addition (40 lines) inside the atomic write path; no API or storage-format changes.
• Uses only std::os::unix::fs::PermissionsExt — no new dependencies.
• Rollback is a revert of the single-file change.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable. (Not applicable: no user-facing change.)

This is an AI-assisted change.