SSH host keys and the database files are created 0600, and a too-open one is named on boot #3025

Owner's finding on #1436 (2026-10-15): a helper pod with fsGroup re-moded /data and secret.key went 0660; the forge's refusal was right and should reach the other secrets on the data volume.

Done looks like:

• [ ] The forge refuses to load an SSH host key under the data directory that is group- or world-readable, with the same one-sentence defect as src/kernel/secret.ts (path, mode, "must be 0600").
• [ ] forge.db, -wal and -shm are created 0600; when one is found group- or world-readable at boot the forge keeps serving but reports it as degraded (the path and the chmod that fixes it), it does not chmod it silently.
• [ ] Tests: a 0640 host key is refused; a 0644 forge.db boots and shows the degraded finding; fresh files are 0600.
• [ ] docs/THREATS.md gains the bullet with its Test: line.

Files: src/ssh/keys.ts, src/kernel/db.ts or src/kernel/preflight.ts, test/, docs/THREATS.md. Risk: production's db files may be 0644 today; that must degrade, never stop the forge.

Parked by the crew: the check failed ("the door starts a watcher for a new child and not for an existing one") and the decider saw no point in another try (pull #3033 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.