fix: clip sync timestamps, exclusive temp files, zeroized secret reads

- sync: timestamps and tombstones in the shared file are clipped to the
  local clock, and an edit wins a tie with a deletion, so a forged
  future-dated record can no longer override every later local change
  (or keep deleting a re-created profile) for as long as the forged date.
- write_private: the temp file is created O_EXCL under a random name, so a
  symlink pre-placed in a shared folder can't be followed or overwritten.
- Vault/keychain reads return Zeroizing<String>; has_sync_password is
  cached for a few seconds instead of fetching the real value every frame.
- generate_ssh_key creates a missing ~/.ssh as 0700.
- Honest wording: encrypted exports and the sync file carry login-script
  values; the audit entry, the Settings hint and the docs now say so.

rust/core/src/sessions/mod.rs

@@ -803,7 +803,7 @@ mod tests {
         // Typed again and accepted: stored.
         resolve(&m, "s1");
         m.finish_connect("s1", e, Ok(Client::None), |_| {});
-        assert_eq!(m.secrets.get(&key).as_deref(), Some("hunter2"));
+        assert_eq!(m.secrets.get(&key).as_deref().map(String::as_str), Some("hunter2"));
         assert_eq!(asked.load(Ordering::SeqCst), 3);
 
         // The saved value is reused; once the server rejects it, the next attempt asks again.