Refuse a manifest entry whose mode is above 0777 on load (closes #225)

Loading accepted an entry recording a mode above 0777, such as 04755.
check then reported a file with exactly the recorded permission bits
as a mode mismatch, list and export printed the out-of-range mode, and
freshen silently rewrote it as the permission bits alone. Loading now
refuses such an entry, naming the path and the mode, so every command
that reads a manifest refuses it with one message. fetch's own check
for this could no longer be reached and is gone; its test moves to the
loading tests in package mfer. docs/FORMAT.md says readers reject a
mode above 0777.

Model: opus-5-5

docs/FORMAT.md

@@ -93,16 +93,15 @@ Each file entry contains:
 ## File Mode
 
 `mode` holds a file's Unix permission bits, the nine `rwx` bits, so it is never
-above `0777` (octal); the setuid, setgid and sticky bits are never recorded.
-Writers record `0000` unless whoever creates the manifest asks for permissions.
-`0000`, the proto3 default, means no mode was recorded: readers never check or
-apply it.
+above `0777` (octal); the setuid, setgid and sticky bits are never recorded. A
+reader must reject a manifest with an entry whose mode is above `0777`. Writers
+record `0000` unless whoever creates the manifest asks for permissions. `0000`,
+the proto3 default, means no mode was recorded: readers never check or apply it.
 
 The reference implementation records modes when `gen` or `freshen` is given
 `--include-permissions`. `check` fails a file whose permission bits differ from
 a recorded mode other than `0000`. `fetch` sets a recorded mode other than
-`0000` on each file it writes, and refuses a manifest that records a mode above
-`0777` before it requests any file.
+`0000` on each file it writes.
 
 ## Path Rules