🛡️ Sentinel: [HIGH] Fix TOCTOU vulnerability in config file creation

[ffalcinelli]

🚨 Severity: HIGH
💡 Vulnerability: Time-of-Check to Time-of-Use (TOCTOU) file permission race condition. When creating or modifying the .pinner.toml file, the tool originally wrote the configuration using std::fs::write (which creates files with default, often globally readable permissions) and later restricted the file's access via fs::set_permissions. This left a brief window during which the sensitive configuration—potentially containing GitHub/GitLab tokens or OCI registry passwords—was exposed to unauthorized read access by other users on the system.
🎯 Impact: Potential leakage of sensitive API keys and registry passwords to unprivileged users on multi-user systems.
🔧 Fix: Replaced the standard file writing logic with explicit file opening operations using std::fs::OpenOptions combined with std::os::unix::fs::OpenOptionsExt's .mode(0o600) function on Unix platforms. This guarantees that the configuration file is created with restricted read/write-only owner access right from the start, completely closing the TOCTOU window.
✅ Verification: Code compiles cleanly via cargo check and cargo clippy, and passes all existing automated test cases via cargo test. Appropriate conditional compilation boundaries (#[cfg(unix)] and #[cfg(not(unix))]) were utilized to ensure Windows cross-compatibility. Recorded learning in .Jules/sentinel.md.

---

PR created automatically by Jules for task 7628173361031299379 started by @ffalcinelli

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.43%. Comparing base (07ac008) to head (b3c0b9c).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #135      +/-   ##
==========================================
- Coverage   88.51%   88.43%   -0.08%     
==========================================
  Files          28       28              
  Lines        2646     2646              
==========================================
- Hits         2342     2340       -2     
- Misses        304      306       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.