pub fn ensure_secret_file(path: &Path) -> Result<()>
Ensure a sensitive append-only file exists with mode 0600 set at creation time. Subsequent appends inherit the mode. No-op if the file already exists.