Function write_private_file 

pub fn write_private_file(path: &Path, bytes: &[u8]) -> Result<()>

Write bytes to path and restrict it to the current user (0600 on Unix). Shared by the file-writing MCP tools; the cookie/fetch CLI writers follow the same contract.