fix: give atomic writes the umask mode

mkstemp creates its scratch 0600 and os.replace kept that mode, so
database.json, the manifests, the packs, the recipe snapshots and the
large-file cache were readable by their owner only. set_plain_mode
gives the scratch 0o666 less the umask, as open() would, before each
rename. A test walks every function that renames a mkstemp file.

scripts/refresh_data_dirs.py

@@ -25,7 +25,7 @@ import urllib.request
 import zipfile
 from collections.abc import Iterator
 from pathlib import Path
-from artifacts import file_lock as _file_lock
+from artifacts import file_lock as _file_lock, set_plain_mode
 from common import github_token, platform_arg, require_platform, yaml_load
 
 try:
@@ -133,6 +133,7 @@ def _save_versions(
         with os.fdopen(handle, "w") as f:
             json.dump(versions, f, indent=2, sort_keys=True)
             f.write("\n")
+        set_plain_mode(scratch)
         os.replace(scratch, path)
     except BaseException:
         with contextlib.suppress(OSError):