Restrict ~/.agent-pulse/config.json to 0600 permissions

[martinbha]

Problem

AgentPulseSettings.writeBridgeConfig() (Sources/AgentPulse/Runtime/AgentPulseSettings.swift) writes the bearer token to ~/.agent-pulse/config.json with default file permissions, so it is readable by other local users on multi-user machines.

Suggested fix

Write the file with 0600 permissions (e.g. pass .posixPermissions: 0o600 via FileManager attributes after the atomic write, or create with restricted permissions up front). Consider 0700 on the ~/.agent-pulse directory as well.

Low severity given the loopback-only threat model, but it matches the intent of having a token at all.

[martinbha]

Completed by PR #81. The settings writer now enforces 0700 on the application support directory and 0600 on config.json after atomic writes, with regression coverage for both permissions.