Refuse a manifest entry whose mode is above 0777 on load (closes #225)

Loading accepted an entry recording a mode above 0777, such as 04755.
check then reported a file with exactly the recorded permission bits
as a mode mismatch, list and export printed the out-of-range mode, and
freshen silently rewrote it as the permission bits alone. Loading now
refuses such an entry, naming the path and the mode, so every command
that reads a manifest refuses it with one message. fetch's own check
for this could no longer be reached and is gone; its test moves to the
loading tests in package mfer. docs/FORMAT.md says readers reject a
mode above 0777.

Model: opus-5-5

internal/cli/fetch.go

@@ -95,9 +95,6 @@ var (
 	// writes another file.
 	errNameClash = errors.New(
 		"manifest lists a file where fetch writes another file")
-	// errModeOutOfRange indicates a manifest that lists a mode with more
-	// than the permission bits, such as setuid.
-	errModeOutOfRange = errors.New("manifest lists a mode outside 0777")
 )
 
 // DownloadProgress reports the progress of a single file download.
@@ -428,9 +425,9 @@ func (mfa *CLIApp) fetchManifestOperation(
 
 // fetchManifest downloads the manifest at manifestURL and parses it,
 // enforcing --require-signature if it is given and refusing a manifest
-// that lists a file where fetch writes another or a mode outside 0777. It
-// returns the manifest as downloaded, to be saved once the files are in
-// place, and the files it lists.
+// that lists a file where fetch writes another. It returns the manifest as
+// downloaded, to be saved once the files are in place, and the files it
+// lists.
 func (mfa *CLIApp) fetchManifest(
 	ctx context.Context, cmd *cli.Command, client retryingClient, manifestURL string,
 ) ([]byte, []*mfer.MFFilePath, error) {
@@ -487,16 +484,6 @@ func (mfa *CLIApp) fetchManifest(
 		return nil, nil, err
 	}
 
-	// fetch sets each recorded mode on the file it writes, so a mode above
-	// 0777, which could carry setuid, setgid or sticky bits, is refused
-	// before any file is requested.
-	for _, f := range files {
-		if f.GetMode() > uint32(os.ModePerm) {
-			return nil, nil, fmt.Errorf("%w: %s (%#o)",
-				errModeOutOfRange, f.GetPath(), f.GetMode())
-		}
-	}
-
 	log.Infof("manifest contains %d files", len(files))
 
 	return manifestData, files, nil