Greptile Summary

This PR adds automatic cleanup of config backup files (.bak, .bak.1, etc.) after successful writes to reduce credential exposure. The implementation adds a cleanupConfigBackups() function that removes all backup files using best-effort error handling, and calls it after both successful write paths (atomic rename and Windows copy-fallback). The cleanup only runs on success, preserving backups for crash recovery when writes fail.

• Added cleanupConfigBackups() function in backup-rotation.ts that removes .bak and numbered backups
• Integrated cleanup calls in io.ts after successful config writes (both rename and copy-fallback paths)
• Added comprehensive tests covering cleanup with existing backups and graceful handling of missing files
• Properly scoped to security issue Config backup (.bak) file persists and contains sensitive data #31699 without over-engineering

Confidence Score: 5/5

• This PR is safe to merge with minimal risk - it's a focused security improvement with proper error handling and test coverage
• The changes are well-implemented with correct logic, comprehensive tests, and appropriate best-effort error handling. The cleanup is properly placed after successful writes and won't interfere with crash recovery. No edge cases or security concerns identified.
• No files require special attention

_{Last reviewed commit: c6ff6c0}