fix: tighten an existing .env to 0600 before rewriting it; CI checks secrets have values

envfile.update only applied 0600 when it created the file, so an existing
.env with a wider mode kept it while secrets were written into it. The mode
is now set on the open descriptor before the file is truncated and written.

The CI step now requires POSTGRES_PASSWORD and JWT_SECRET_KEY to have values:
an empty one falls back to a default without any check noticing.

tests/deploy/test_envfile.py

@@ -76,6 +76,16 @@ class TestUpdate:
         envfile.update(path, {"JWT_SECRET_KEY": "s"})
         assert oct(os.stat(path).st_mode & 0o777) == oct(0o600)
 
+    @pytest.mark.skipif(sys.platform == "win32", reason="POSIX permissions")
+    def test_an_existing_readable_file_is_made_private_before_writing(self, tmp_path):
+        """Secrets are rewritten into the file, so a permissive mode left from before must not stay."""
+        path = tmp_path / ".env"
+        path.write_text("LLM_PROVIDER=openai\n")
+        os.chmod(path, 0o644)
+        envfile.update(path, {"JWT_SECRET_KEY": "s"})
+        assert oct(os.stat(path).st_mode & 0o777) == oct(0o600)
+        assert envfile.read(path) == {"LLM_PROVIDER": "openai", "JWT_SECRET_KEY": "s"}
+
     def test_rejects_a_newline_in_a_value(self, tmp_path):
         with pytest.raises(ValueError, match="newline"):
             envfile.update(tmp_path / ".env", {"A": "1\n2"})