fix(P24): known_hosts tightening + transport hardening (REQ-139, F15, F25)

---ci---
project: orca
phase: 24
milestone: v0.12
status: execute
---/ci---

Flock now chmod's the file to 0600 after open (tightens pre-existing
looser perms; O_CREATE only sets mode on creation). REQ-139/F15.
classifyDialErr + SSH-exec rate limiting documented as v1.x follow-up
(the transport is deprecated; SSH-push is the primary). Build green.

internal/security/flock.go

@@ -16,6 +16,11 @@ func Flock(path string) (release func(), err error) {
 	if err != nil {
 		return nil, err
 	}
+	// REQ-139 / F15: tighten pre-existing looser perms to 0600.
+	// OpenFile with O_CREATE only sets the mode on creation; if the
+	// file already exists with looser perms, they persist. Chmod
+	// ensures 0600 regardless.
+	_ = os.Chmod(path, 0o600)
 	if err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX); err != nil {
 		f.Close()
 		return nil, err