Write secret data with platform-appropriate restrictive permissions.
Carved out of cli/src/platform/mod.rs so every trust crate shares one
byte-identical secret writer. Pure std + std::process::Command; no app
coupling and no windows crate (the DACL path shells out to icacls).