fix: brief world-readable file window in ConversationStore.save() (L1)

[sfegette]

Summary

Data.write(to:options:.atomic) renames the temp file to the target path before setAttributes runs, briefly exposing the conversation file at 0o644. On a shared or compromised system this is a narrow but real read window.

Fix

Replace the Data.write + setAttributes sequence with:

1. Choose an explicit temp path (e.g. url.deletingLastPathComponent().appendingPathComponent(UUID().uuidString))
2. Write to the temp path
3. Apply 0o600 to the temp path via setAttributes
4. FileManager.moveItem (atomic rename) to the final path

This ensures the file is never world-readable at the final path.

Notes

Related to M1 — fix both in the same PR to avoid touching save() twice.