fs: default writeSecureFile to 0600 (owner-only)

[1seal]

writeSecureFile currently defaults to 0o640, which makes created files group-readable. Since this helper is used to write credential material (directly or via downstream actions), this changes the default to 0o600 while keeping the ability for callers to override mode explicitly.

Changes:

• Update writeSecureFile default mode to 0o600
• Update unit tests to assert the new default and keep coverage for custom mode
• Update generated docs/dist outputs accordingly

Compatibility:

• Callers that relied on group-readable defaults can restore the previous behavior by passing mode: 0o640 explicitly.

Testing:

• npm test
• npm run lint

[1seal]

closing as duplicate of #154 (same writeSecureFile 0600 change).