- Replace chmod 644 temp file with install(1) -m 600 for atomic copy
with correct ownership — eliminates world-readable window in /tmp
- Move ${HOME}/.claude volume mount from base docker-compose.yml to
optional docker-compose.claude-cli.yml overlay — avoids breaking
deployments where $HOME is unset (CI/CD, systemd, Swarm)