Create credential files with owner-only permissions

[lukiod]

Credential files were written with write_text and then chmod'd to 0600:

tmp.write_text(json.dumps(data, indent=2), encoding="utf-8")
with contextlib.suppress(OSError):
    tmp.chmod(0o600)

Two problems. The file exists with the default umask (usually 0644) between the write and the chmod, so the token is briefly readable by any local user. And the chmod is suppressed, so if it fails the file just stays 0644 with nothing reported.

Adds strix/utils/secret_files.py with write_secret_text, which opens with O_CREAT | O_EXCL and mode 0600 so the file never exists with wider permissions, and uses it for the viewer auth file and the env block.

Tests in tests/test_secret_files.py. The permission assertions are POSIX-only and skip on Windows, which is where I ran them — 2 passed, 4 skipped locally.

[greptile-apps]

Greptile Summary

The PR centralizes sensitive-text persistence in a new owner-only atomic writer.

• Replaces post-write chmod sequences for Codex credentials, CLI configuration, and viewer authentication.
• Creates temporary files with mode 0600 and attempts to restrict their parent directory to 0700.
• Adds content, overwrite, umask, directory-mode, and stale-temporary-file tests.

Confidence Score: 4/5

The concurrent temporary-file race should be fixed before merging because simultaneous credential writes can fail or publish malformed data.

The helper improves creation-time permissions, but all writes to a destination share an unprotected temporary pathname that concurrent viewer requests or CLI processes can delete or reuse.

Files Needing Attention: strix/utils/secret_files.py, strix/viewer/auth.py

Important Files Changed

Filename	Overview
strix/utils/secret_files.py	Adds restricted atomic writes, but the shared deterministic temporary pathname is unsafe under concurrent writes.
strix/config/codex.py	Migrates subscription credential persistence to the helper and therefore inherits its concurrent-write failure.
strix/config/loader.py	Migrates persisted environment configuration to owner-only creation.
strix/viewer/auth.py	Migrates viewer credentials to the helper, exposing its temporary-file race through threaded request handling.
tests/test_secret_files.py	Covers permissions and sequential stale temporary files but not concurrent writes to the same destination.

Prompt To Fix All With AI

### Issue 1
strix/utils/secret_files.py:24-30
**Shared temporary path races**

When two requests or processes write the same credential file concurrently, both use and unlink the same `.tmp` path, causing one write to raise `FileExistsError` or interfere with the other writer and publish malformed data. This is reachable through simultaneous OTP verification requests handled by the threaded viewer server.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "fix: create credential files with owner ..." | Re-trigger Greptile}