fix(config): protect credentials before writing configuration

[overtrue]

Fixes #357.

ConfigManager::save previously wrote alias credentials before tightening file permissions. An interrupted or failed write could leave the configuration readable by other local users.

Create new Unix configuration files with mode 0600 and tighten existing files through the opened file handle before truncating or writing. Add regression coverage that forces writes to fail under a permissive umask, checks both new and existing files, and verifies that shorter configuration updates remove stale trailing content.

Protected-file review — BREAKING marker required by repository policy: this permission fix touches crates/core/src/config.rs. The configuration schema remains at version 1, existing files remain compatible, and no data migration is needed.

Validation on macOS:

• cargo fmt --all --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace — 2,649 passed, 2 ignored
• The permission regression fails against the original implementation and passes with the fix.