Workspace mounts record every file as 0644 and re-create it at 0644, whatever its mode on disk #479

What's wrong

The workspace ignores file permissions everywhere it reads or writes a file (main e670363):

• src/modules/workspace/reconcile.ts:870 stores every ingested file with mode: 0o644.
• index.ts:2106 defaults a change's mode to 0o644.
• effects.ts:184 creates a file that is missing from disk at 0o644.
• Nothing under src/modules/workspace/ calls chmod or fchmod.

So a read-write, watched mount versions owner-only files (a .env, a token file, a 0600 config) as 0644. After an undo, a redo or a branch switch, materialize writes a removed file back at 0644, under the usual umask.

Why it matters

Restoring session history can quietly widen a file's permissions. connectome-host#278 tracks one slice of this, the _config mount. The behaviour applies to every read-write mount. Git loses 0600 the same way, so this may be intended. If it is, the workspace docs should say so.

How it was found

Tracing R1-2 of the #371 review through the workspace module. Found by reading the code, not reproduced end to end.

Suggested fix

Record the on-disk mode at ingest (at least the read bits) and apply it on materialize. Or keep 0644 and document that workspace history doesn't preserve permissions.

Found during our review of #371: #371 (review)

_{Posted by the maintainer's desk assistant.}