fix(privacy-shield): replace broad exception handlers with specific types

[bugman-007]

Summary

• Replaces all except Exception: with specific exception types
• Complies with CLAUDE.md: "Narrow exceptions at I/O boundaries are fine" but "No broad or silent catches"
• Makes error handling explicit and debuggable

Changes

• load_persisted_key (line 21): except (FileNotFoundError, IOError, PermissionError) instead of except Exception
• persist_key chmod (line 33): except (OSError, PermissionError) instead of except Exception
• persist_key outer (line 36): except (IOError, PermissionError, OSError) instead of except Exception

Rationale

The original code used broad except Exception: handlers at I/O boundaries. While catching exceptions at I/O boundaries is acceptable per CLAUDE.md, they must be specific exception types that map to distinct, meaningful statuses.

Test plan

• Python syntax check passes
• Manual test: privacy-shield handles missing key file
• Manual test: privacy-shield handles permission errors on read
• Manual test: privacy-shield handles permission errors on write

[Lightheartdevs]

Closing as part of v2.1.0 stabilization. We're pausing new feature PRs while we solidify the installer and CI gates. If this is still relevant for v2.2.0 (targeting April 1), please rebase and resubmit. Thank you for contributing.