[Security]: session JSON artifacts are written world-readable on unix (0o644 default umask)

Summary: On unix, session JSON artifacts written through JsonFileStore (session transcripts, metadata, token usage) are published with permissions inherited from the process umask — typically 0o644 — making prompt/output content world-readable on multi-user hosts.

Area: Agent runtime / core

Reproduction or evidence: src/crates/services/services-core/src/json_store.rs:306 writes the payload to a temp file (fs::write) and renames it into place without any permission tightening; the file contains no set_permissions/PermissionsExt/0o600 logic anywhere. On a unix host with default umask 022, the published artifact is world-readable (-rw-r--r--).

Environment: BitFun version/commit 32f2427697ee16f253ee6119860a03255c0b3e47 (origin/main); reproducible on any unix host with default umask (verified by code-path analysis; unix CI matrix exercises the fixed behavior).

Comienza en src/crates/services/services-core/src/json_store.rs:306 y rastrea cómo JsonFileStore escribe y cambia el nombre de los artefactos de sesión en Unix. Verifica el modo de archivo resultante con una umask 0o22 y, después, confirma la finalización cuando los archivos JSON de sesión no sean legibles por todo el mundo y las comprobaciones de Unix pasen.