Function write_secret_file 

pub fn write_secret_file(path: &Path, bytes: &[u8]) -> Result<(), Error>

Write bytes to a new file at path that only the owner can read.

For exports that carry secret material, such as backup envelopes.

• The file is opened with create_new, so an existing path (including a symlink, dangling or not) is never truncated or followed. The call fails with std::io::ErrorKind::AlreadyExists and the caller decides whether to remove the old file first.
• On Unix the file is created with mode 0600, so it is not readable by anyone else at any point, including between create and write.
• The data is flushed with sync_all before returning.
• On Windows the owner-only DACL from restrict_file_to_owner is applied after the write.

Unlike the other helpers in this module, a hardening failure is an error. If any step after the file is created fails, the file is removed, so no secret is left behind with the wrong permissions and a retry is not blocked by AlreadyExists.