security: enforce 0600/0700 file permissions on sensitive files

Enforces owner-only permissions on files and directories that contain
secrets or sensitive data. Previously, all files were created with
default umask permissions, which could allow other users on shared
systems to read API keys, config, and cron job data.

Changes:
- hermes_cli/config.py: Added _secure_dir()/_secure_file() helpers,
  ensure_hermes_home() sets 0700 on all dirs, save_config() sets 0600
  (save_env_value already had this from a prior commit)
- cron/jobs.py: Added matching helpers, ensure_dirs() sets 0700,
  save_jobs() and save_job_output() set 0600/0700
- cli.py: save_config_value() sets 0600 after writing config
- 8 new tests in tests/test_file_permissions.py

All chmod calls wrapped in try/except for Windows compatibility.

Cherry-picked from PR #757, rebased onto current main with conflict
resolution (save_config now uses atomic_yaml_write).

Closes #757

cli.py

@@ -1060,6 +1060,12 @@ def save_config_value(key_path: str, value: any) -> bool:
         with open(config_path, 'w') as f:
             yaml.dump(config, f, default_flow_style=False, sort_keys=False)
         
+        # Enforce owner-only permissions on config files (contain API keys)
+        try:
+            os.chmod(config_path, 0o600)
+        except (OSError, NotImplementedError):
+            pass
+        
         return True
     except Exception as e:
         logger.error("Failed to save config: %s", e)