Function write_private_atomic 

pub fn write_private_atomic(
    path: &Path,
    bytes: &[u8],
    exclusive: bool,
) -> Result<(), IdentityError>

Write bytes to path via a temp file in the same directory and an atomic rename, mode 0600 from creation (never briefly wider).

With exclusive the final step is a hard link that fails when path exists (two creators cannot both win); otherwise the rename replaces.