write secret and key files atomically with their final mode

Each of these wrote its file in place (or set the mode after the
write), so a write cut short by a kill or a full disk left a partial
file behind, and some secrets existed for a moment at umask mode:

- swarm-authelia/swarm-grafana/hive-forge/swarm-bao generators: a
  partial file passed the `-s`/`-e` guard and was kept forever. They now
  capture the value first and land it with `atomic_write_secret`.
- swarm-controller webhook secret: a truncated file failed the 64-hex
  check and the secret was regenerated, out of step with the forge
  hooks. It is now written 0600 to a sibling temp, fsynced, renamed.
- hive-c0re htpasswd: the temp is now fsynced and set 0644 before the
  rename, like the sibling agents.conf writer, instead of relying on
  c0re's umask.
- hivectl wg init: the private key is created 0400 in a temp and
  renamed, instead of written at umask mode and chmod'ed after.

Closes #5068

nix/host-modules/hive-forge/default.nix

@@ -65,6 +65,7 @@ let
 
   baoCfg = config.services.hyperhive.swarm.bao;
   storeRetry = import ../lib/store-retry.nix { };
+  atomicWriteSecret = import ../lib/atomic-write-secret.nix { };
   havePublisherIdentity =
     deployCfg.bao.forgePublisherClientCertFile != null
     && deployCfg.bao.forgePublisherClientKeyFile != null;
@@ -916,6 +917,8 @@ in
             script = ''
               set -euo pipefail
 
+              ${atomicWriteSecret}
+
               # Idempotent by query, same reasoning as the SSO unit: assert
               # the effect, not the command's exit code. `--admin`: the
               # controller creates repos in the agents org on the swarm's
@@ -982,8 +985,7 @@ in
                   echo "no token-shaped word in forgejo's generate-access-token output" >&2
                   exit 1
                 fi
-                umask 0177
-                printf '%s' "$token" > "$token_path"
+                atomic_write_secret 0600 "" "$token_path" "$token"
                 echo "minted forge access token for ${swarmControllerForgeUser}"
               fi
             '';