[Bug] writeConfig is not atomic — mid-write crash corrupts user config

## Problem

`writeConfig` calls `writeFileSync` directly on the target path. If the process is killed or the machine loses power mid-write, the config file is left in a partial state — subsequent `readConfig` calls trigger a JSON parse error and the user loses their entire configuration (see the companion silent-null bug in the same file).

## Location

**File:** `packages/desktop/src/main/workspace/config.ts:168-172`

```typescript
export function writeConfig(config: AppConfig): void {
const cfgPath = configFilePath();
const encrypted = encryptGatewayCredentials(config);
writeFileSync(cfgPath, JSON.stringify(encrypted, null, 2), { encoding: 'utf-8', mode: 0o600 });
}
```

## Fix Approach

Use the classic write-to-temp-then-rename pattern:

1. Write the encoded JSON to `cfgPath + '.tmp'` with the same `mode: 0o600`.
2. Call `renameSync(cfgPath + '.tmp', cfgPath)` — `rename` is atomic on both POSIX and NTFS.
3. On write failure, best-effort clean up the temp file before re-throwing the original error.

## Verification

1. Run `pnpm check` — must pass.
2. Manual: force-kill the process immediately after a `writeConfig` invocation, relaunch — config must be either the old version or the new version, never a half-written mix.

## Context

- **WG:** Artifact & File System
- **Priority:** Low
- **Estimated effort:** 20-30 minutes

Start in packages/desktop/src/main/workspace/config.ts at writeConfig, especially lines 168-172, and inspect the existing config read/write helpers. Use the specified temporary-file and rename behavior while preserving mode 0o600 and cleanup on failure. Run pnpm check, then verify that interrupted writes leave either the old or new configuration rather than partial JSON.

Written by the indexing model from the issue text.