fix: harden local grit state handling

[kocaemre]

Summary

• make .grit/config.json owner-only (0600) when saving local config
• fail closed on malformed config instead of silently falling back to the local backend
• reject degenerate identifiers that are ., start with ., or end with .
• restrict the local room socket to owner-only permissions (0600)

Verification

• cargo test --quiet → 79 passed
• Manual local checks confirmed:
  • saved config mode changes from world-readable 0644 to 0600
  • malformed config now exits with an error instead of reporting backend: local
  • --agent . is rejected before lock handling
  • room socket mode changes from 0755 to 0600

Notes

This keeps the current Azure config shape intact, but prevents accidental local disclosure via default filesystem permissions and avoids unsafe backend fallback on corrupted config files.

[github-actions]

Thanks for the PR! It looks like this targets master, but contributor PRs should target the develop branch.

master is reserved for stable releases (only develop -> master PRs cut by maintainers via release-please).

To fix:

1. Click Edit at the top right of this PR
2. Change the base branch from master to develop

See docs/RELEASE_FLOW.md for the release flow.

[kocaemre]

Thanks for the heads up — updated the PR base branch to develop. I also verified the head is still mergeable and the existing target-branch check is green.