pub(super) fn put(dir: &Path, key: &str, secret: &str) -> Result<(), String>
Write via a fresh 0600 temp file and a rename, so a reader never sees a partial secret and a crash never leaves one behind.
0600