fix: cache file permission window, export-env quoting, shell guardrail gap

[DustyStudy]

Summary

Follow-up to #18/#20: the remaining lower-priority items from the original review — cache file permissions, export-env quoting, a real guardrail gap on shell, and the doc claims that didn't match. One commit per fix, each with regression tests checked against the pre-fix code.

1. Cache files were briefly world-readable before chmod locked them down. put() wrote with Path.write_text() (mode from the process umask) then chmod'd afterward — a real window on POSIX systems during which a brand-new token/credentials file was readable by anyone. Now created via os.open() with an explicit 0o600 mode, set atomically. Still best-effort on Windows, same as before.
2. export-env's output wasn't quoted. Credential values were interpolated straight into export KEY="value" / $env:KEY = "value". AWS credentials never actually contain shell metacharacters, but the values come from an external API response, so the interpolation itself shouldn't be a foot-gun for whatever evals it. POSIX lines now go through shlex.quote(); PowerShell lines escape `/"/$.
3. protected_account_ids didn't actually cover shell, despite guardrails.yaml documenting it as blocking "ANY command via orgctl exec/shell" — spawn_shell() never called into guardrails at all. Pulled the protected-account check out of check_command() into its own check_protected_account() and wired it into spawn_shell() too. export-env/creds-process stay intentionally uncovered (documented in the example config) since they're meant to work non-interactively.
4. Docs corrected. README's "Security model" and the threat model's asset table both claimed credentials are never exported outside the one child process, full stop — but export-env/creds-process print them to stdout by design. Scoped the claim to exec/shell and described what those two commands actually guard instead.

Verification

• ruff check, ruff format --check, mypy src: clean.
• pytest: 116 passed, 5 skipped (POSIX-only checks that don't apply on the Windows dev box — they run for real on the ubuntu-latest CI runners); coverage 70% → 73%.
• Every regression test was checked against the pre-fix code (via git stash per file) and confirmed to fail there for the right reason, then pass with the fix. New tests/test_export_env.py includes an end-to-end test that actually evals the generated POSIX line in a real shell with a value containing shell metacharacters, and checks the value comes back unmangled rather than executed.

Not in this PR

Two intentionally-out-of-scope items surfaced along the way and documented rather than changed: export-env/creds-process don't get blocked by protected_account_ids (by design — see commit 3), and orgctl still has no signature/integrity check on orgs.yaml/guardrails.yaml themselves (pre-existing, named in the threat model's "explicitly out of scope" section).