fix: give atomic writes the umask mode

mkstemp creates its scratch 0600 and os.replace kept that mode, so
database.json, the manifests, the packs, the recipe snapshots and the
large-file cache were readable by their owner only. set_plain_mode
gives the scratch 0o666 less the umask, as open() would, before each
rename. A test walks every function that renames a mkstemp file.

scripts/generate_pack.py

@@ -14,7 +14,7 @@ from __future__ import annotations
 
 from collections.abc import Callable, Iterator
 
-from artifacts import _build_timestamp
+from artifacts import _build_timestamp, set_plain_mode
 import argparse
 import contextlib
 import functools
@@ -221,6 +221,7 @@ def _writing_pack(zip_path: str) -> Iterator[zipfile.ZipFile]:
     try:
         with zipfile.ZipFile(scratch, "w", zipfile.ZIP_DEFLATED) as zf:
             yield zf
+        set_plain_mode(scratch)
         os.replace(scratch, zip_path)
     except BaseException:
         Path(scratch).unlink(missing_ok=True)
@@ -4573,6 +4574,7 @@ def inject_manifest(zip_path: str, manifest: dict) -> None:
                         continue
                     dst.writestr(item, src.read(item.filename))
                 _write_generated_member(dst, "manifest.json", manifest_json)
+        set_plain_mode(scratch)
         os.replace(scratch, zip_path)
     except BaseException:
         Path(scratch).unlink(missing_ok=True)