fix: give atomic writes the umask mode

mkstemp creates its scratch 0600 and os.replace kept that mode, so
database.json, the manifests, the packs, the recipe snapshots and the
large-file cache were readable by their owner only. set_plain_mode
gives the scratch 0o666 less the umask, as open() would, before each
rename. A test walks every function that renames a mkstemp file.

scripts/ziptools.py

@@ -14,6 +14,7 @@ import sys
 import tempfile
 import zipfile
 
+from artifacts import set_plain_mode
 from hashing import md5sum
 
 
@@ -141,6 +142,7 @@ def _write_member_cache(path: str, data: dict[str, list[list]]) -> None:
     try:
         with os.fdopen(fd, "w", encoding="utf-8") as fh:
             json.dump(data, fh, separators=(",", ":"))
+        set_plain_mode(scratch)
         os.replace(scratch, path)
     except OSError as exc:
         print(f"warning: could not write {path}: {exc}", file=sys.stderr)