Record file mode in the manifest, 0000 unless asked (closes #161)

MFFilePath gains mode (field 304): a file's permission bits, 0777 at
most, or 0000, meaning none recorded. gen and freshen record real modes
only with --include-permissions (ScannerOptions.IncludePermissions); the
builder keeps only mode.Perm(), so setuid, setgid and sticky are never
written. list -l and export show the mode in octal. check reports
MODE_MISMATCH for a recorded mode other than 0000 the file lacks. fetch
refuses a manifest with a mode above 0777 before requesting any file,
sets only the permission bits of each recorded mode on the files it
writes, and downloads again a present file whose mode differs. The decoding-cost bound counts a file
entry at 176 bytes, up from 160.

Model: opus-5-5

mfer/mf_test.go

@@ -41,6 +41,7 @@ func TestFileEntryFieldsMatchSpec(t *testing.T) {
 		"mimeType": 301,
 		"mtime":    302,
 		"ctime":    303,
+		"mode":     304,
 	}
 
 	got := map[string]protoreflect.FieldNumber{}