fix(security): use atomic install for PAM file writes in touchid

replace all sudo mv calls with sudo install -m 444 -o root -g wheel
to prevent PAM files from inheriting user ownership and mode 0600.
sudo mv preserves the temp file's inode attributes, leaving
/etc/pam.d/sudo writable by the unprivileged user (local privilege
escalation). install(1) atomically copies content with correct
ownership and permissions, closing the TOCTOU window.