Harden elevated config and shadow setup

[r266-tech]

改动

• 为 wxkey 配置写入增加跨进程锁、0600 原子替换与 symlink 防护
• 限制提权配置路径，并固定使用系统 sudo
• 将 Shadow WeChat 构建改为受管目录内随机 staging、降权执行与原子发布
• 升级 Go 基线到 1.26.5

原因与影响

避免并发 key/image-key 写入互相覆盖，并收紧提权路径和 shadow app 的文件系统竞态。正常 wxkey bootstrap/setup/image-key 工作流保持不变。

验证

• go test ./... -count=1
• go test -race ./... -count=1
• go vet ./...
• go mod verify
• govulncheck ./...：No vulnerabilities found
• git diff --check

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.