perf(hash): replace twox-hash with xxhash-rust and optimize file hashing
- Replace `twox-hash` (XxHash64 via Hasher trait) with `xxhash-rust`'s
direct `xxh64()` function call. The xxhash-rust crate has a more
optimized implementation and the direct function avoids Hasher trait
overhead. Same algorithm, same output, no cache invalidation.
- Pre-allocate read buffer in `git_like_hash_file` based on file
metadata size, eliminating repeated Vec reallocations during
`read_to_end` for every file hashed.
- Add criterion benchmarks for both turborepo-hash (task/global/file
hash computation) and turborepo-scm (file content hashing at various
sizes).
https://claude.ai/code/session_01JTwyUFFEGSJK1RUxGfBx8K
fix: Restrict credential file permissions to owner-only (0o600)
Credential files (config.json, auth.json) were created via
fs::File::create() which inherits the process umask, typically
resulting in world-readable 0o644 permissions. On shared systems,
this allowed other local users to read Vercel API tokens.
Add create_with_contents_secret() that sets 0o600 atomically at
file creation time on Unix, and explicitly tightens permissions
on pre-existing files. Use it for all credential write paths:
turbo login, auth token refresh, and logout config rewrite.