Apply restored owners, modes and times in an order that keeps them (closes #219)

A directory got its stored mode and mtime before its contents were
written, so a read-only directory came back without its files and a
non-empty one carried the time of the restore. Directories are now
created owner-only (0700) and get their stored owner, mode and mtime
after the restore loop, each before its parent, skipping any whose
place a symlink has since taken. A file's mode is now applied after its
chown, which on Linux clears setuid and setgid. A symlink gets its
stored owner (as root) and mtime on the link itself, through
golang.org/x/sys/unix, now a direct dependency.

An interrupted restore leaves its directories at 0700.

Model: opus-5-5

TODO.md

@@ -22,6 +22,17 @@ the tag exists and is exercised; what is left is merging `next` to
 
 # Completed Steps
 
+- 2026-10-06: Made restore apply owners, modes and times in an order
+  that keeps them
+  ([issue #219](https://git.eeqj.de/sneak/vaultik/issues/219)). A
+  directory got its stored mode and mtime before its contents were
+  written, so a read-only directory came back without its files and a
+  non-empty one carried the time of the restore. Directories are now
+  created owner-only and get their stored owner, mode and mtime once the
+  restore loop is done, each before its parent. A file's mode is applied
+  after its chown, which on Linux clears setuid and setgid, and a
+  symlink gets its stored owner (as root) and mtime on the link itself.
+
 - 2026-10-06: Made `go.mod` what `go mod tidy` writes, so the
   pre-commit hook no longer stops every commit
   ([issue #246](https://git.eeqj.de/sneak/vaultik/issues/246)). A test