Fix private key backup restore semantics

[mfat]

Summary

• Clamp restored private-key file permissions so archived group/other bits are not reapplied.
• Keep merge-mode restore as an all-or-nothing key-pair skip: when the private key already exists, skip its public sidecar too.
• Add regression tests for unsafe private-key modes and whole key-pair skip semantics.

Testing

• pytest tests/test_backup_manager.py

  

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.