enhancement: make runtime privacy and locking portable

[codeforester]

Summary

• preserve POSIX owner-only runtime permissions;
• use inherited user-profile ACLs on Windows instead of claiming POSIX mode-bit semantics;
• make private log/JSON writes avoid ineffective Windows chmod calls;
• use a binary-safe sidecar locking path for msvcrt history appends;
• add concurrent append and Windows-backend regression coverage;
• document custom cache-root privacy responsibilities.

Fixes #37

Validation

• uv run --no-project --with pytest --with click --with PyYAML python -m pytest
• ./tests/validate.sh

107 tests passed.