fix: harden runtime state and job output

[owainlewis]

Summary

• make the public inbox-triage example portable and disabled by default
• create and repair state and audit files with owner-only permissions on Unix
• preserve atomic state replacement while securing the temporary file before rename
• escape malformed filenames and control characters in push job list
• add focused regression coverage for every path

Why

The main branch was red because the public job example contained a machine-specific workdir and enabled schedule. Runtime state and audit logs also relied on umask despite containing sensitive metadata, and malformed job filenames could inject rows or terminal controls into list output.

This PR restores the missing terminal hardening from the intent of #147 without reverting main's newer table formatter. PR #152 remains the separate canonical Pi unattended-resource fix.

Verification

• cargo test --all-targets (333 unit tests, 1 documentation test, 12 init CLI tests, 3 manual crash/recovery tests)
• cargo clippy --all-targets --all-features -- -D warnings
• cargo build --release --locked
• cargo fmt --all -- --check
• git diff --check
• bash tests/release-version.sh
• bash tests/install.sh
• uv run --with-requirements requirements-docs.txt mkdocs build --strict
• two fresh independent reviews; the first found a post-rename error path, it was fixed, and the second approved with no blocker or important findings

Risk

Windows-specific file replacement behavior and live multi-process audit writes were not exercised. The non-Unix permission helper remains a no-op as before.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 32e1be6602

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".