Create custom run-dir ancestors privately #498

Source: #477 (comment)

Bug

A custom --run-dir with missing parents still uses Path.mkdir(..., parents=True). Python applies the requested 0700 mode only to the final leaf; intermediate parents are derived from the process umask. Under collaborative umask 002 or 000, another principal can rename or replace the private run leaf through a writable ancestor before later lifecycle commands reopen it by path.

Expected

Every missing custom-run ancestor and the final run directory is created explicitly with requested mode 0700; failures do not continue into a partially trusted path.

Acceptance

• Add a focused regression with at least two missing custom-run ancestors under umask 002 and 000.
• Assert every created level is 0700.
• Preserve existing custom run-dir behavior and lifecycle output.

Primary source: https://docs.python.org/3/library/pathlib.html#pathlib.Path.mkdir