ci(obs): chmod 600 obs-secrets.env after creation in both workflows

The heredoc creates the file with default umask permissions (644 —
world-readable). Setting 600 immediately after creation prevents other
processes on the host from reading the Grafana, GlitchTip, and Postgres
credentials. Defence-in-depth for the single-tenant VPS.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/nightly.yml

@@ -146,6 +146,7 @@ jobs:
           POSTGRES_PASSWORD=${{ secrets.STAGING_POSTGRES_PASSWORD }}
           POSTGRES_HOST=archiv-staging-db-1
           EOF
+          chmod 600 /opt/familienarchiv/obs-secrets.env
 
       - name: Validate observability compose config
         # Dry-run: resolves all variable substitutions and reports any missing

.gitea/workflows/release.yml

@@ -114,6 +114,7 @@ jobs:
           POSTGRES_PASSWORD=${{ secrets.PROD_POSTGRES_PASSWORD }}
           POSTGRES_HOST=archiv-production-db-1
           EOF
+          chmod 600 /opt/familienarchiv/obs-secrets.env
 
       - name: Validate observability compose config
         # Dry-run: resolves all variable substitutions and reports any missing