Create missing shard-output ancestors privately #494

Source review comment:
#477 (comment)

Exact reviewed SHA: 05e72a7a689524d0b8d74ea7e30096ac2a1c2cac

Trigger

Merge shards to an output_run path with multiple missing ancestors under
umask 002 or 000.

Expected

Every newly created shard-output ancestor is private.

Actual

Path.mkdir(parents=True, mode=0o700) applies 0700 only to the leaf and
creates intermediate directories through the process umask.

Impact

Another principal can rename or replace the private merged run between later
commands that reopen it by path.

Required regression

Create each missing shard-output ancestor explicitly at 0700 from the nearest
existing parent, and prove every created level under collaborative umasks.