fix: secure setup service env file

[Kingson4Wu]

Summary

• create and update the setup service .env with mode 0600
• preserve non-writing setup planning so english-pilot setup --json does not create runtime directories or .env
• add regression coverage for both permission hardening and no-mutation planning

Verification

• npm run typecheck
• npm test
• pnpm exec vitest run tests/integration/installer.test.ts
• loop architecture assessment: score 98 / target 95
• push hook project-health suite passed during branch push

Notes

• One confirmed production-risk permissions bug fixed. Deferred non-confirmed candidates: old session normalization and setup wording.