fix(security): harden temp file permissions for sensitive data

### Description

In goose's Rust codebase, temp files may be created for handling sensitive data (API keys in logs, tool outputs, etc.). Ensuring 0o600 permissions is important for multi-user systems.

### Suggested audit

- Search for `NamedTempFile`, `tempfile`, `std::fs::write` with sensitive content
- Ensure 0o600 on Unix
- Add explicit permission setting where needed

### Location

- `crates/goose/src/agents/`
- `crates/goose/src/session/`
- Any credential handling

### Fix

```rust
use std::os::unix::fs::PermissionsExt;
let file = tempfile::NamedTempFile::new()?;
std::fs::set_permissions(file.path(), Permissions::from_mode(0o600))?;
```

### Why

Goose handles API keys, private code, and user data. Defense in depth.

Happy to PR.