Create release files owner-only before publication

[omar07ibrahim]

Outcome

• create every release output with mode 0600 while bytes are still being written
• apply the intended final 0644 or 0755 mode only after the full payload is present
• add a regression proving the creation mode and final executable mode
• remove the test wrapper’s permissive 0777 default after CodeQL found it independently

Why

CodeQL alert #1 correctly identified that the production helper passed the final public mode directly to O_CREAT. A follow-up exact-head scan then identified the test wrapper default as alert #2. Both are fixed in code; neither alert was dismissed.

Exact-head validation

• head: eb0362c
• CI run 31290288723: both jobs successful
• 145 locked unit tests; 100% statements (1136/1136) and branches (362/362)
• Ruff lint/format and strict mypy successful
• two byte-identical releases plus fresh-wheel verification successful
• CodeQL run 31290287547: Actions and Python successful
• PR CodeQL aggregate successful; zero open PR alerts

Release boundary

The already published v0.3.0 annotated tag and audited assets remain immutable. This hardens post-release build tooling on master; it does not rewrite the tag or replace release bytes.