fix(update): restrict permissions on rollback snapshot directory in ods-update.sh

[vaibhavsrv]

Why this matters

During snapshot_pre_update and cmd_backup in ods/ods-update.sh, rollback snapshot and backup directories are created via mkdir -p without explicitly restricting filesystem permissions. Because live .env and .env.* configuration files containing sensitive database passwords, external tokens, and credentials are copied into these directories, default umask settings (e.g., 0022) leave the target directory world-readable or group-readable, resulting in accidental credential exposure on shared or multi-tenant hosts.

This change surgically adds chmod 700 immediately following directory creation in both snapshot_pre_update and cmd_backup. The fix ensures private state and secrets remain restricted strictly to the executing user without altering backup filenames, copy semantics, or migration lifecycle logic.

Validation

• Baseline reproduction: Without explicit mode enforcement, snapshot and backup directories inherited umask permissions (0755), allowing non-owner accounts read access to copied .env credentials.
• Post-fix behavior: snapshot_pre_update and cmd_backup enforce 0700 (rwx------) permissions upon creation.
• Telemetry: Update suites: 2 passed. New-test Ruff, ShellCheck, and diff checks pass; new regressions wired into Linux CI.

Overlap check

Recent PRs #6326 (multiple backup arg validation in ods-restore.sh), #6325 (option validation in ods-backup.sh), and #6324 (atomic write in hermes) address argument parsing and context generation across separate utilities. None touch the pre-update snapshot directory creation in ods-update.sh. This PR operates strictly within ods/ods-update.sh and does not duplicate or conflict with their changes.

Risk / AI disclosure

AI-assisted investigation, implementation and CLI regressions. This strengthens filesystem permissions on backup directories, not runtime admission. Independent human review and platform/runtime qualification remain gates. No running configuration, deployment or upstream merge changed.

Follow-up integration evidence

Composed with #6326 at af95a5f without conflicts. Production and test diffs passed together; backup and restore checks remain intact.
Backlog composition was local-only (production/test diffs, excluding workflow/Makefile wiring); it is not an upstream merge or independent human approval. Declared live-review gates remain open.

[Lightheartdevs]

Thanks for this contribution. public-beta was promoted into main on 2026-09-24 and no longer receives changes, so we're closing pull requests that target it. This isn't a judgment on the change itself. If it's still needed, please rebase onto main and open a focused PR. See #7253 for details and the contribution policy.