fix: give atomic writes the umask mode

mkstemp creates its scratch 0600 and os.replace kept that mode, so
database.json, the manifests, the packs, the recipe snapshots and the
large-file cache were readable by their owner only. set_plain_mode
gives the scratch 0o666 less the umask, as open() would, before each
rename. A test walks every function that renames a mkstemp file.

scripts/largefiles.py

@@ -19,6 +19,7 @@ from collections import Counter
 from collections.abc import Iterable
 from pathlib import Path
 
+from artifacts import set_plain_mode
 from hashing import compute_hashes
 
 
@@ -219,6 +220,7 @@ def _fetch_asset(
             compute_hashes(tmp_path), expected_sha1, expected_md5
         ):
             return None
+        set_plain_mode(tmp_path)
         os.replace(tmp_path, cached)
         return cached
     finally: