Replace provider credential files atomically

[piclaw-bot]

Replace credential files atomically

Refs #1458 and #1442; both stay open.

• Stage complete credential JSON in a same-directory wx 0600 file, fsync/close it, atomically rename and sync the POSIX directory under the existing cross-process lock.
• Preserve old bytes on pre-commit failure; keep the new credential authoritative after rename even if directory sync fails, recording only generic/metadata diagnostics.
• Reject directly supplied symlink/hardlink/nonregular targets and enforce owned POSIX credential parent/file 0700/0600 with no-follow descriptor validation/read. Initial creation uses exclusive wx.
• Test I/O failures, partial staging, descriptor/cleanup errors, post-commit directory failure and owned SIGKILL at partial/before/after rename checkpoints.

Scope is app-owned private POSIX parent and process-crash visibility. No power-loss/Windows/general filesystem certification, owning-UID/ancestor attack guarantee or automatic orphan staging cleanup. Abrupt death may leave a private credential-bearing temp file; retention needs separate review. Legacy secrets/backups, full provider/CLI/device/Delegate/live acceptance stay open.

No live accounts, inference, deployment or restart. App-owned fault I/O seam; no private SDK imports or lock-option/clock manipulation.

Validation

Failure/store/crash set: 30 pass / 166 assertions. Post-crossprocess-merge lifecycle/store/crossprocess opt-in set: 40 pass / 219. All five types, strict fixture types, scoped lint, diff and scoped independent review pass. One initial unchanged concurrency test hit its existing five-second budget; unchanged rerun22/115 passed with no timeout changes. Frozen canonical gate: 5,969 passed, eight skipped, zero failures; 25 feature and nine web checks passed. Pack hygiene: 24,742 files. Final five types/diff passed at baseline e7539b67a; unchanged compose baseline. Seven existing skips plus prior opt-in stale-lock case separately passed in the 40-test run. Private Bun cache, shared-cache permissions unchanged.