fix: close daemon profile creation race

[EivMeyer]

Summary

• create Unix daemon profile directories with owner-only mode in the initial mkdir operation
• restore exact owner access after umask filtering without ever exposing group or other access
• add 32-contender regressions for simultaneous first-time creation and restrictive-umask creation
• keep concurrent listener startup fail-closed when authenticated liveness is temporarily indeterminate

Why

Two starters could both observe a missing profile directory. The winner created it with default permissions and only tightened it afterward, so the other starter could transiently reject the directory as insecure. This was surfaced by the concurrent daemon-listener test in PR #863.

The listener assertion also assumed every safe loser must report AlreadyRunning, although the documented liveness contract permits LivenessIndeterminate during the publication-to-accept-loop handoff. Both outcomes preserve the winning locator; discovery and security errors remain rejected.

Validation

• cargo fmt --all -- --check
• cargo clippy -p zeroshot-rust --test daemon_discovery --test daemon_listener
• cargo test -p zeroshot-rust --test daemon_discovery (10 passed)
• cargo test -p zeroshot-rust --test daemon_listener (19 passed)
• concurrent profile-creation regression: 1,000 consecutive passes
• restrictive-umask concurrent-creation regression: 500 consecutive passes
• concurrent listener-start regression: 1,000 consecutive passes

[greptile-apps]

Greptile Summary

The PR closes the Unix daemon profile-creation race by requesting owner-only permissions during initial directory creation and repairing owner bits removed by restrictive umasks.

• Revalidates profile directories after restoring owner access.
• Adds concurrent profile-creation and restrictive-umask regression coverage.
• Accepts both fail-closed loser outcomes during concurrent listener startup.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
zeroshot-rust/src/daemon_discovery.rs	Creates profile directories with mode 0700 and restores umask-filtered owner permissions before revalidation, resolving the previously reported startup failure.
zeroshot-rust/tests/daemon_discovery.rs	Adds concurrent first-time profile creation and restrictive-umask regression tests.
zeroshot-rust/tests/daemon_listener.rs	Aligns the concurrent-start assertion with the documented fail-closed liveness outcomes.

_{Reviews (2): Last reviewed commit: "fix: restore daemon profile owner access" | Re-trigger Greptile}

[greptile-apps]

Want your agent to iterate on Greptile's feedback? Try greploops.