fix(security): resolve dependency vulns, stream I/O, harden credentials and install script

[brandonrc]

Summary

Addresses 6 security-critical audit findings:

• 8 known dependency vulnerabilities including 3 HIGH severity #65: Updated dependencies resolving 7 of 8 vulnerabilities (aws-lc-sys 0.39.0, quinn-proto 0.11.14, rustls-webpki 0.103.10). Note: time 0.3.45 remains pinned by ratatui-widgets, tracked separately.
• File uploads and downloads read entire content into memory #66: Refactored artifact push/pull/copy to stream files instead of reading entire content into memory. Uploads use ReaderStream, downloads write chunks directly to disk. Prevents OOM on large artifacts.
• Credential files written without restrictive permissions #67 + Setup commands write package manager configs without restrictive permissions #79: All credential and config file writes now set 0o600 permissions on Unix. Config directories set to 0o700. Applied to credentials.json, config.toml, and all setup command output files (.npmrc, pip.conf, etc.).
• Install script continues without checksum verification #73: Install script now exits with error when no checksum tool is found instead of silently continuing.
• APT setup leaks plaintext token to stderr #80: Token values in setup preview output are redacted (shows first4...last4 instead of full token).

Test Checklist

• Unit tests added/updated
• Integration tests added/updated (if applicable)
• E2E tests added/updated (if applicable)
• Manually tested locally
• No regressions in existing tests (1380 passing)

API Changes

• N/A - no API changes

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud