hive-c0re: stop silently dropping errors on credential/marker writes

Add secret_file::write_secret_0600: create the parent dir, write a
sibling temp file opened create_new + mode 0600, sync_all, rename over
the target. Use it for the matrix sender token, the space/chat room-id
files and the forge core token, which previously wrote at the process
umask, then chmod-ed with the error discarded, and dropped the
create_dir_all error. agent_identity::write_identity uses it too
instead of its own open-0600 loop; that loop opened with create +
truncate, so a pre-existing file kept its old mode.

Also log instead of discarding:
- the manager's applied-rev marker write in auto_update
- the knowledge `git remote set-url` scrub (spawn error and non-zero
  exit; the exit status only, since stderr may echo the old URL)
- the parent create_dir_all in paths::move_if_legacy

Closes #5037

hive-c0re/src/forge/users.rs

@@ -147,14 +147,9 @@ async fn mint_token(name: &str, scopes: &str) -> Result<String> {
 /// by hive-c0re itself (under `/var/lib/hyperhive/`), so a direct
 /// write is both correct and necessary (no priv round-trip).
 async fn mint_and_persist_core_token(path: &Path) -> Result<()> {
-    use std::os::unix::fs::PermissionsExt;
     let token = mint_token("core", CORE_TOKEN_SCOPES).await?;
-    if let Some(parent) = path.parent() {
-        std::fs::create_dir_all(parent).ok();
-    }
-    std::fs::write(path, format!("{token}\n"))
+    crate::secret_file::write_secret_0600(path, format!("{token}\n").as_bytes())
         .with_context(|| format!("write core token to {}", path.display()))?;
-    let _ = std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o600));
     tracing::info!(path = %path.display(), "forge: persisted core access token");
     Ok(())
 }