On macOS, a report saved in a folder with inheritable ACL permissions could remain readable by other users even with mode 0600.

Clear inherited access from the already-open temporary file before writing report data, using the same protection as baseline files. If access cannot be restricted, preserve the old report and remove the temporary file. Baseline ownership, ACL preservation, and atomic writes keep their existing behavior.

Validation:

• Fresh source and installed-wheel runs: 594 report/baseline tests passed in each mode; eight macOS-specific tests skipped on Linux.
• All 20 report-format checks and 48 sample-skill scans passed, with matching findings and behavior after excluding generated IDs and scan metadata.
• Native macOS checks reproduced the old exposure and confirmed its removal using the release candidate's source and wheel. The report and baseline helpers are byte-for-byte identical to this PR; this is shared-helper evidence, not a full macOS run of this main-branch wheel.
• Lint, formatting, wheel packaging, and both independent review tools passed.