Regular files are now created with O_EXCL at mode 0600 and given their
stored mode only after the content is written and closed, so a file
whose stored mode is restrictive is never briefly readable by other
local users mid-restore. A file whose write or close fails is removed
rather than left partial, and a chmod failure is a user-visible warning
instead of a debug line.
hashVerifyReader.Close now errors when closed before EOF, so a short
read or early close can never obtain a blob whose hash was not verified;
downloadBlobToCache drops the cache entry on any such failure.
verifyFile (--verify) now rejects a restored file with bytes past its
last chunk.
Tests cover each behaviour under umask 022.
Model: opus-4-8
sneak