fix(init): .env is never readable by other users

[catinspace-au]

.env holds every secret make init generates, and all five writers opened it under the umask. On the standing devex VM (umask 002) it was 664, so any local user could read the stack's passwords.

• One helper in _common.py, write_private, creates the file at its mode and reasserts that mode on rewrite. init, dev_posture, render_dial and stack write .env through it. The .env backup and the access summary (already 0600) now use it too.
• .env is 0640, not 0600. A daemon install shares the checkout through its group (the VM's ubuntu user reads .env via group dfe), and env/ is already group-shared on purpose.
• make init closes an EXISTING .env to others (o-rwx) and leaves the owner and group bits alone, so upgraded installs get fixed on their next init.
• post.py's forced-password rewrite already keeps the file's mode via mkstemp, so it needs no change.

make check-python and check-tests: 462 passed. check-docs is clean. Done when a new or upgraded install's .env has no permission bits for others.