fix: clip sync timestamps, exclusive temp files, zeroized secret reads

- sync: timestamps and tombstones in the shared file are clipped to the
  local clock, and an edit wins a tie with a deletion, so a forged
  future-dated record can no longer override every later local change
  (or keep deleting a re-created profile) for as long as the forged date.
- write_private: the temp file is created O_EXCL under a random name, so a
  symlink pre-placed in a shared folder can't be followed or overwritten.
- Vault/keychain reads return Zeroizing<String>; has_sync_password is
  cached for a few seconds instead of fetching the real value every frame.
- generate_ssh_key creates a missing ~/.ssh as 0700.
- Honest wording: encrypted exports and the sync file carry login-script
  values; the audit entry, the Settings hint and the docs now say so.

docs/guide/chapters/part5-yours.tex

@@ -85,7 +85,8 @@ after you change a profile, every ten minutes and whenever you click \ui{Sync No
 \begin{checklist}
   \item[\color{green}\iCheck] Edited on two machines? The newer change wins, profile by profile.
   \item[\color{green}\iCheck] Deleted on one machine? It goes from the others too (unless someone edited it afterwards).
-  \item[\color{rose}\ph{E4F6}] Passwords, keys and tokens never sync. Each machine keeps its own in its keychain or vault.
+  \item[\color{rose}\ph{E4F6}] Saved passwords, keys and tokens never sync. Each machine keeps its own in its keychain or vault.
+        (Anything a login script \emph{sends} is part of the profile, so that does travel.)
 \end{checklist}
 
 \crop{settings-security.png}{581}{253}{576}{285}{0.8\linewidth}{Profile sync lives on the Security page, under your stored credentials.}