fix(credentials): guard fchmod on Windows

[OllieinCanada]

Fixes #1868

Summary

Guard the POSIX-only os.fchmod call when atomically writing credentials so
OAuth token refreshes can persist rotated credentials on Windows.

The write path still applies mode 0600 whenever fchmod is available. On
platforms without it, the existing atomic write, file fsync, and replacement
continue normally.

Impact

Previously, the refresh request could succeed and rotate the server-side
refresh token, then Windows would raise AttributeError before writing the new
token. The credentials file retained the now-invalid old token and subsequent
refreshes failed with invalid_grant.

Tests

• deterministic regression with os.fchmod removed
• security regression proving available fchmod is called with 0600
• existing end-to-end mocked refresh/write-back test
• tests/lib/test_credentials.py: 219 passed, 4 skipped
• ruff check .
• targeted Ruff format, Pyright, and Mypy checks
• dependency-cap validation and import smoke test
• git diff --check

No real credentials, API calls, or external services are used by the
regression tests.

[OllieinCanada]

Native Windows validation on exact head cece0266498e3e1cb0104e0f9e30aebaee5dbe11 is green:

• Python 3.10: tests/lib/test_credentials.py — 219 passed, 4 skipped
• Ruff lint and format checks passed for both touched files
• a direct production-path smoke test confirmed os.fchmod is absent, _atomic_write_credentials() still atomically wrote and re-read dummy rotated credentials, and no temporary file remained
• git diff --check passed and the worktree is clean

The smoke test used an isolated temporary directory and no real credentials, API calls, or external services.

[tomer-ant]

Can you move these tests under the security: credentials file permissions section? Right now they're under the "type": "authorized_user" section