hive-c0re: stop silently dropping errors on credential/marker writes

Add secret_file::write_secret_0600: create the parent dir, write a
sibling temp file opened create_new + mode 0600, sync_all, rename over
the target. Use it for the matrix sender token, the space/chat room-id
files and the forge core token, which previously wrote at the process
umask, then chmod-ed with the error discarded, and dropped the
create_dir_all error. agent_identity::write_identity uses it too
instead of its own open-0600 loop; that loop opened with create +
truncate, so a pre-existing file kept its old mode.

Also log instead of discarding:
- the manager's applied-rev marker write in auto_update
- the knowledge `git remote set-url` scrub (spawn error and non-zero
  exit; the exit status only, since stderr may echo the old URL)
- the parent create_dir_all in paths::move_if_legacy

Closes #5037

hive-c0re/src/paths.rs

@@ -295,8 +295,14 @@ fn move_if_legacy(old: &Path, new: &Path) {
     if !old.exists() || new.exists() {
         return;
     }
-    if let Some(parent) = new.parent() {
-        let _ = std::fs::create_dir_all(parent);
+    if let Some(parent) = new.parent()
+        && let Err(e) = std::fs::create_dir_all(parent)
+    {
+        tracing::warn!(
+            dir = %parent.display(),
+            error = ?e,
+            "relocate: create parent dir failed"
+        );
     }
     match std::fs::rename(old, new) {
         Ok(()) => tracing::info!(