Windows owner-only protection for the sc keygen identity file and the TLS serve key (follow-on to #214) #281

#279 protects .sc/local-key with an owner-only DACL on Windows via winacl::create_new_owner_only. Two other secret files still get default permissions on non-unix: the identity file written by sc keygen --out (0600 on unix only) and the TLS serve key under the serve home (tlsio load_or_mint). Reuse the winacl helper (it lives in scl-repo; keygen is in cli and the TLS key in tlsio, which must not depend on workspace crates: add the helper to scl-core or pass a 'create owner-only' callback from repo), add Windows CI coverage in the advisory Windows job, update THREAT-MODEL.