chore: harden temporary secret file cleanup in CI

.gitea/workflows/cicd.yml

@@ -22,6 +22,8 @@ jobs:
         env:
           SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
         run: |
+          umask 077
+          trap 'rm -f ~/.ssh/id_rsa' EXIT
           echo "=== Minimal Repository Checkout for Base Dockerfile ==="
 
           # Set up SSH key securely (temporary file approach)
@@ -166,6 +168,8 @@ jobs:
         env:
           SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
         run: |
+          umask 077
+          trap 'rm -f ~/.ssh/id_rsa' EXIT
           echo "=== Minimal Repository Checkout for Complete Dockerfile ==="
 
           # Set up SSH key securely (temporary file approach)
@@ -196,6 +200,8 @@ jobs:
           GITHUB_SHA: ${{ github.sha }}
           REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.actor }}
         run: |
+          umask 077
+          trap 'rm -f /tmp/ssh_key' EXIT
           echo "=== Building Complete CICD Image with Secure Secrets ==="
 
           # Login to registry