Route credential bundle publication through the create-only staged writer and exclusive file writes, remove command-local chmod and staging code, and enforce native sol-client ownership through cargo-deny.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>