Keep forecast ledger backups private

[teddyjfpender]

Summary

• create ledger backups atomically with mode 0600
• harden the default backup directory to 0700 and migrate retained snapshots to 0600
• remove incomplete reserved backups if the SQLite copy fails

Validation

• scripts/run_tests.sh tests/test_ledger_backup.py tests/test_jobs_backup_type.py -q — 15 passed
• pre-push hermetic gate — 24,150 passed, 92 skipped
• live backup quick_check=ok; directory 0700; all retained backups 0600

[github-actions]

🔎 Lint report: fix/private-ledger-backups vs origin/superforecasting-agent-snapshot

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 13182 on HEAD, 13182 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 6307 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.