pub fn write_private_file(path: &Path, bytes: &[u8]) -> CliResult<()>
Writes a new file readable only by its owner (mode 0600 on Unix); fails if it exists.