fix(lib): hardening and edge-case bugfixes (FW-12, FW-16 round)

- Restored .bak generation to maintain P0-B backup invariants
- Fixed stale NFS warning message to reflect SQLite DELETE fallback
- Replaced vulnerable yaml.replace with os.path.splitext globally
- Ensured YAML dump occurs after conn.commit() to prevent partial syncs
- Re-applied chmod 0600 on SQLite -wal and -shm files

skills/tmux-agent-orchestrate-status/scripts/status.sh

@@ -37,7 +37,7 @@ home = os.environ['HOME_DIR']
 claude_project_dir = os.environ.get('CLAUDE_PROJECT_DIR', f"{home}/.claude/projects")
 drift = json.loads(os.environ['DRIFT_JSON'])
 
-db_path = yaml_path.replace('.yaml', '.db')
+db_path = os.path.splitext(yaml_path)[0] + '.db'
 d = {}
 import sqlite3
 try: