Apply restored owners, modes and times in an order that keeps them (closes #219)

A directory got its stored mode and mtime before its contents were
written, so a read-only directory came back without its files and a
non-empty one carried the time of the restore. Directories are now
created owner-only (0700) and get their stored owner, mode and mtime
after the restore loop, deepest first, so a parent that denies search
does not block its children. A file's mode is now applied after its
chown, which on Linux clears setuid and setgid. A symlink gets its
stored owner (as root) and mtime on the link itself, through
golang.org/x/sys/unix, now a direct dependency.

An interrupted restore leaves its directories at 0700.

Model: opus-5-5

TODO.md

@@ -22,6 +22,17 @@ the tag exists and is exercised; what is left is merging `next` to
 
 # Completed Steps
 
+- 2026-10-06: Made restore apply owners, modes and times in an order
+  that keeps them
+  ([issue #219](https://git.eeqj.de/sneak/vaultik/issues/219)). A
+  directory got its stored mode and mtime before its contents were
+  written, so a read-only directory came back without its files and a
+  non-empty one carried the time of the restore. Directories are now
+  created owner-only and get their stored owner, mode and mtime once the
+  restore loop is done, deepest first. A file's mode is applied after
+  its chown, which on Linux clears setuid and setgid, and a symlink gets
+  its stored owner (as root) and mtime on the link itself.
+
 - 2026-10-06: Made `snapshot restore --skip-errors` skip the files that
   need a blob it cannot download
   ([issue #218](https://git.eeqj.de/sneak/vaultik/issues/218)). A missing