fix(native): create TLS private keys at mode 0600, not chmod after write

[pedrofrxncx]

Bug, found while auditing apps/native release/updater code.

local_tls::write_private is the only place the per-machine CA root key and the per-launch leaf key ever hit disk. It wrote the key bytes with fs::write (which creates the file at the process's default, umask-derived mode — typically 0644), then called fs::set_permissions to tighten it to 0600 in a second syscall. Between those two steps the key sat world/group-readable.

The file's own module doc calls out exactly this threat model: "a stolen ca-key.pem — readable by any process running as this user, including code the app itself runs in sandboxes — would be a general-purpose authority for every TLS connection this user makes." The write-then-chmod ordering left a real (if narrow) window for that.

Fix: open the file with OpenOptionsExt::mode(0o600) so it's created at 0600 from the first syscall — no window. Also re-asserts the mode after open (via set_permissions) to handle the case where a key file predating this fix already exists on disk with looser permissions from a prior run.

Verification: added two unit tests — write_private_creates_the_file_mode_0600 (new file lands at exactly 0600) and write_private_tightens_a_pre_existing_looser_file (a pre-existing 0644 file gets tightened and its contents replaced). Both pass:

cd apps/native/src-tauri && cargo test --lib local_tls::

(Needed a placeholder binaries/rclone-<target> file locally to satisfy build.rs's sidecar-binary check — that's an unrelated pre-existing dev-setup requirement, not part of this diff.)

Ran cargo fmt -- --check src/local_tls.rs (clean). cargo clippy isn't installed in this sandbox's toolchain; CI's rust-checks job covers it.

Only apps/native/src-tauri/src/local_tls.rs is touched — one file, one concern, +56/-9.

---

Summary by cubic

Writes TLS private keys with mode 0600 at creation on Unix, removing the write-then-chmod window that briefly exposed keys at umask-derived perms (typically 0644). New behavior opens the file with OpenOptionsExt::mode(0o600) and also re-asserts 0600 after open to tighten pre-existing files when rewritten.

• Scope: apps/native/src-tauri/src/local_tls.rs only; behavior change is Unix-only. Non-Unix still uses the existing write path.
• Security impact: closes a race that could leave ca-key.pem or leaf keys group/world-readable between syscalls.
• Tests: adds two unit tests to verify 0600 creation and tightening on rewrite.
• Migration: if a machine has an existing key at 0644 that is not rewritten, manually chmod 600 or rotate the key; future writes will auto-tighten.

^{Written for commit 259a21f. Summary will update on new commits.}