hive-c0re: stop silently dropping errors on credential/marker writes

Add secret_file::write_secret_0600: create the parent dir, write a
sibling temp file opened create_new + mode 0600, sync_all, rename over
the target. Use it for the matrix sender token, the space/chat room-id
files and the forge core token, which previously wrote at the process
umask, then chmod-ed with the error discarded, and dropped the
create_dir_all error. agent_identity::write_identity uses it too
instead of its own open-0600 loop; that loop opened with create +
truncate, so a pre-existing file kept its old mode.

Also log instead of discarding:
- the manager's applied-rev marker write in auto_update
- the knowledge `git remote set-url` scrub (spawn error and non-zero
  exit; the exit status only, since stderr may echo the old URL)
- the parent create_dir_all in paths::move_if_legacy

Closes #5037

hive-c0re/src/workers/auto_update.rs

@@ -208,8 +208,10 @@ pub async fn ensure_root_agent(coord: &Arc<Coordinator>) -> Result<()> {
     if let Err(e) = coord.power.set(MANAGER_NAME, crate::power::Wanted::Up) {
         tracing::warn!(error = ?e, "agent_power: set manager wanted=up failed");
     }
-    if let Some(rev) = current_rev {
-        let _ = std::fs::write(crate::paths::applied_rev_marker(MANAGER_NAME), &rev);
+    if let Some(rev) = current_rev
+        && let Err(e) = std::fs::write(crate::paths::applied_rev_marker(MANAGER_NAME), &rev)
+    {
+        tracing::warn!(name = MANAGER_NAME, error = ?e, "write rev marker failed");
     }
     Ok(())
 }

hive-c0re/src/workers/knowledge.rs

@@ -109,10 +109,24 @@ pub async fn pull(coord: &Coordinator) -> Result<()> {
     // place this repo stored a token in a named remote. Harmless to repeat
     // once the URL is already clean.
     let plain = crate::forge::forge_git_url(&format!("{ORG}/{REPO}"));
-    let _ = crate::lifecycle::git_command()
+    // Logs the exit status only: git's stderr may echo the old, credentialed URL.
+    match crate::lifecycle::git_command()
         .args(["-C", LOCAL_DIR, "remote", "set-url", "origin", &plain])
         .output()
-        .await;
+        .await
+    {
+        Ok(out) if out.status.success() => {}
+        Ok(out) => tracing::warn!(
+            remote = "origin",
+            status = %out.status,
+            "knowledge: git remote set-url failed; a credentialed origin URL may remain"
+        ),
+        Err(e) => tracing::warn!(
+            remote = "origin",
+            error = ?e,
+            "knowledge: spawning git remote set-url failed"
+        ),
+    }
     // Discard any local drift before pulling — both tracked (`reset --hard`)
     // and untracked (`clean -fd`). Nothing in this codebase writes to
     // `LOCAL_DIR` after the initial clone — this working tree exists to mirror