Harden suggestion store JSON permissions

[Widthdom]

Summary

• Write primary suggestions-*.json stores through the existing atomic private-file mode callback path.
• Add POSIX regression coverage for owner-only suggestion store files.
• Document the suggestion store permission contract.

Validation

• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~SuggestionStoreTests" -c Debug -p:UseSharedCompilation=false
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet format CodeIndex.sln --verify-no-changes
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet test CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet build CodeIndex.sln -c Debug -p:UseSharedCompilation=false
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• Codex adversarial review against origin/main..HEAD: no actionable correctness or regression issues found.

Documentation / Changelog

• Updated DEVELOPER_GUIDE.md filesystem permissions contract in English and Japanese.
• Added changelog fragment: changelog.d/unreleased/3267.security.md.

Scope

• Related issue check for SuggestionStore private permissions found only Suggestion store JSON should be written with private permissions #3267.
• No follow-up candidates.

Fixes #3267