Both writers already go through atomic_json_write(mode=0o600) but were missing from tests/test_private_credential_writers.py::_writers, so a "write then chmod" regression in either would not be caught. Also removes the `import os` left unused in agent/secret_sources/_cache.py (ruff F401).