fs: default writeSecureFile to 0600 (owner-only)

[1seal]

summary
writeSecureFile currently defaults to 0o640, which makes created files group-readable. since this helper is used to write credential material (directly or via downstream actions), this changes the default to 0o600 while keeping the ability for callers to override mode explicitly.

changes

• update writeSecureFile default mode to 0o600
• update unit tests to assert the new default and keep coverage for custom mode
• update generated docs/dist outputs accordingly

compatibility
this is a behavior change for callers that relied on the previous default group-readable permissions. those callers can restore the old behavior by passing mode: 0o640 explicitly.

testing

• npm test
• npm run lint\n\ncloses writeSecureFile defaults to group-readable mode (0640) #153