Protect Windows DACLs throughout safeWriteText publication #2392

Summary

Design and implement Windows DACL protection for safeWriteText. A file with a restrictive DACL can be written in a directory with broader inherited permissions. The current implementation uses POSIX modes for its staging directory and backup copy, then restores the target DACL after publication. A failed icacls /restore is silent, so a caller can receive success when the published file has broader permissions.

Affected areas

• src/services/file-safety/safeWriteText.ts
• src/services/file-safety/__tests__/safeWriteText.spec.ts
• src/services/file-safety/__tests__/safeWriteText.integration.spec.ts

Required work

• Design Windows DACL protection for staging and backup files before sensitive bytes are written or copied. Include the caller-supplied tempPath case.
• Apply the appropriate target DACL before publication. Fail closed before publication if the required protection cannot be established.
• Report any post-commit ACL failure with the published target path and the underlying cause. Make clear that publication already occurred; do not imply rollback or reuse PostCommitDurabilityError for an ACL failure.
• Add Windows tests for restrictive target DACLs, staging and backup protection, and ACL failure paths. Verify publication state, error details, and cleanup.

Sequencing

The maintainer must decide whether this work is required before PR #2385 merges or belongs in the next unit. The saved Security Boundaries assessment for PR #2385 is blocking; its status has not been rechecked for the current revision.

Requested by @easonLiangWorldedtech.

PR: #2385
Review thread: #2385 (comment)