Harden Murmur state file handling

[fedoseevstanislav]

What changed

• set daemon umask to 0077 before state/database creation
• create state directories as 0700 and atomically create/replace secret JSON as 0600
• reject symlinked, non-regular, and wrong-owner config paths
• read configs with O_NOFOLLOW and re-check the opened descriptor
• use the secure helper in config init/join/peer/notifier/OpenClaw/demo and runtime scripts
• force SQLite database/WAL/shared-memory files to 0600 and reject unsafe database paths
• stop OpenClaw config setup from printing secret-bearing fields
• document that local message bodies remain plaintext and require a dedicated identity plus encrypted storage or explicit retention

Why

Murmur agent configs contain long-term signing/encryption private keys and NATS credentials. Existing writers inherited permissive umasks and rewrites could return configs to 0664; SQLite files containing decrypted message history were also commonly 0644.

Validation

• npm test — complete repository suite passed
• secure state tests cover atomic rewrite, exact modes, permissive-mode repair, and symlink rejection
• core SQLite test verifies 0600 database creation
• npm run build
• git diff --check

This is immediate file-handling containment. OS-identity separation, key/token rotation, backup handling, and plaintext-history encryption/retention remain deployment responsibilities.

Tracks fedoseevstanislav/ops#729.