fix(config): tighten existing secrets file permissions

[jbg]

Summary

• enforce owner-only permissions whenever an existing Unix secrets file is rewritten
• repair permissions before truncating the file so failures preserve existing contents
• add regression coverage for permissive existing files while retaining fresh-file coverage

Validation

• cargo test -p goose test_existing_secrets_file_permissions_tightened_on_write
• cargo test -p goose test_secrets_file_created_with_restricted_permissions
• cargo build -p goose
• cargo clippy -p goose --all-targets -- -D warnings

This finding was discovered by Project Loupe.

[alexhancock]

Looks good to me as a more logical progression of attempt permissions change, wipe, write.