write secret and key files atomically with their final mode

Each of these wrote its file in place (or set the mode after the
write), so a write cut short by a kill or a full disk left a partial
file behind, and some secrets existed for a moment at umask mode:

- swarm-authelia/swarm-grafana/hive-forge/swarm-bao generators: a
  partial file passed the `-s`/`-e` guard and was kept forever. They now
  capture the value first and land it with `atomic_write_secret`.
- swarm-controller webhook secret: a truncated file failed the 64-hex
  check and the secret was regenerated, out of step with the forge
  hooks. It is now written 0600 to a sibling temp, fsynced, renamed.
- hive-c0re htpasswd: the temp is now fsynced and set 0644 before the
  rename, like the sibling agents.conf writer, instead of relying on
  c0re's umask.
- hivectl wg init: the private key is created 0400 in a temp and
  renamed, instead of written at umask mode and chmod'ed after.

Closes #5068

nix/host-modules/swarm-bao.nix

@@ -3526,8 +3526,8 @@ in
                 # expression, which would render it world-readable into the store.
                 for p in so-pin user-pin; do
                   if [ ! -e ${tokenStoreDir}/$p ]; then
-                    ( umask 077; openssl rand -hex 16 > ${tokenStoreDir}/$p )
-                    chmod 0400 ${tokenStoreDir}/$p
+                    pin=$(openssl rand -hex 16)
+                    atomic_write_secret 0400 "" ${tokenStoreDir}/$p "$pin"
                   fi
                 done