fix: lock down config and credentials permissions (600/700)

start.sh

@@ -91,6 +91,7 @@ mkdir -p /home/node/.openclaw/agents/main/sessions
 mkdir -p /home/node/.openclaw/credentials
 mkdir -p /home/node/.openclaw/workspace
 chmod 700 /home/node/.openclaw
+chmod 700 /home/node/.openclaw/credentials
 
 # ── Validate HF token (if provided) ──
 if [ -n "$HF_TOKEN" ]; then
@@ -235,6 +236,7 @@ fi
 
 # Write config
 echo "$CONFIG_JSON" > "/home/node/.openclaw/openclaw.json"
+chmod 600 /home/node/.openclaw/openclaw.json
 
 # ── Startup Summary ──
 echo ""