fix(logging): harden log storage and cleanup

tests/unit/services/logging/log-paths.test.ts

@@ -3,6 +3,7 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 import {
+  ensureLoggingDirectories,
   getCurrentLogPath,
   getLogArchiveDir,
   getNativeLogsDir,
@@ -43,4 +44,14 @@ describe('logging path helpers', () => {
       false
     );
   });
+
+  it('creates log directories with restrictive permissions', () => {
+    ensureLoggingDirectories();
+
+    const logsMode = fs.statSync(getNativeLogsDir()).mode & 0o777;
+    const archiveMode = fs.statSync(getLogArchiveDir()).mode & 0o777;
+
+    expect(logsMode).toBe(0o700);
+    expect(archiveMode).toBe(0o700);
+  });
 });