Restrict safeWriteJson staging permissions during streaming #2361

Summary

Change src/utils/safeWriteJson.ts to create its staging file with restrictive permissions, and add the in-flight regression test in the same file-safety unit. Do not land the test ahead of the implementation.

At PR #1917 revision 6093d2a07cb2f05f9120f2d42fe0f238558dec63, _streamDataToFile calls fsSync.createWriteStream without an explicit mode. The staging file therefore uses the process default mode until _copyTargetMode runs after streaming. If the umask permits group or other access and the directory is accessible, staged JSON can be readable even when the published target is 0o600.

The existing src/utils/__tests__/safeWriteJson.test.ts mode test checks the target after publication. It does not inspect the staging file while streaming.

Acceptance criteria

• Create the staging file with an explicit restrictive mode, such as 0o600 subject to the process umask, before writing JSON bytes.
• Add a POSIX regression test that inspects the actual staging file while streaming is in progress. Under a controlled permissive umask, assert 0o600 before publication. Keep the existing post-publication target-mode and content checks. The in-flight assertion should fail against the current default-mode implementation.
• Preserve the existing target-mode behavior and verify the relevant error and cleanup paths.
• During file-safety lineage convergence, preserve or reapply the lock-key drift refusal and staging-directory re-verification from the applicable safeWriteJson.ts generation, together with their regression coverage. Check these safeguards in the target generation before merging.
• Carry the implementation and its spec together in the unit that changes staging behavior.

Context

• Requested by @easonLiangWorldedtech.
• Pull request: fix(task-persistence): delete under the canonical lock key (U9, #1375) #1917
• Review thread: fix(task-persistence): delete under the canonical lock key (U9, #1375) #1917 (comment)
• Related staging-name and recovery convergence issue: safeWriteText's staging-name guard and jsonFileRecovery's leftover prefixes are mutually exclusive #2350