Keep .env and secret files at mode 600

Domain: security · Evidence E0 — Contributor self-reported

secretschmodenvsecuritylinuxagent

Summary

API keys in `.env` are world-readable. Other users or leaked backups expose tokens.