fix: use Windows ACLs for credential file permissions in backup import (#56923)

[hashbender]

Summary

os.chmod(path, 0o600) is a no-op on Windows — the file keeps its default 0o666 mode bits. This means credential-shaped files restored by hermes import are not tightened on Windows.

Changes

Add _restrict_file_permissions() helper to hermes_cli/backup.py:

• POSIX: calls os.chmod(path, 0o600) as before
• Windows: uses ctypes to call SetFileSecurityW / SetNamedSecurityInfoW with a DACL granting full access only to the current user and SYSTEM
• Fallback: clears world-readable bits if Windows API calls fail

Replaces two bare os.chmod(target, 0o600) calls (lines 604, 648) with the cross-platform helper.

Why ctypes instead of pywin32

The pywin32 package (win32security) is an optional dependency. Using ctypes to call advapi32 directly avoids adding a hard dependency for a single function.

Fixes

Fixes NousResearch#56923

---

Mirror-of: NousResearch#56949
NousResearch#56949