Function write_entry_file 

fn write_entry_file(path: &Path, entry: &AgentEntry)

Write one (agent, channel) entry file, atomically (temp file + rename) so a concurrent reader never observes a partially-written file. Mode 0600 on Unix at open time — same auth_key exposure boundary as the per-channel registry (§5 of the cross-channel spec: same-user trust boundary, not cross-user).