fix: give atomic writes the umask mode

mkstemp creates its scratch 0600 and os.replace kept that mode, so
database.json, the manifests, the packs, the recipe snapshots and the
large-file cache were readable by their owner only. set_plain_mode
gives the scratch 0o666 less the umask, as open() would, before each
rename. A test walks every function that renames a mkstemp file.

scripts/common.py

@@ -2805,6 +2805,8 @@ from artifacts import (  # noqa: E402,F401
     write_if_changed,
     write_text_atomic,
     copy_file_atomic,
+    plain_file_mode,
+    set_plain_mode,
     ArtifactLockBusy,
     artifact_lock,
     hold_artifact_lock,