Consolidate the data directory mode into one owner (closes #288)

internal/datadir now owns the DATA_DIR mode as an exported constant,
DirPerm; internal/database consumes it in both places that create the
directory rather than keeping its own copy. datadir is the owner
because guarding and creating DATA_DIR is its whole purpose, and the
dependency runs the right way: datadir imports only the standard
library and the flock package, so database importing datadir adds no
cycle. A comment on DirPerm names it as the single source, chosen over
a source-scanning test because it survives refactoring and builds no
machinery that inspects the tree. The mode value is unchanged.

Model: opus-4-8

internal/datadir/lock.go

@@ -29,9 +29,11 @@ import (
 // process that was killed with SIGKILL blocks nothing.
 const LockFileName = "webhooker.lock"
 
-// dirPerm is the mode Acquire creates DATA_DIR with. It matches what
-// internal/database uses, since whichever runs first creates it.
-const dirPerm = 0o750
+// DirPerm is the mode DATA_DIR is created with. It is the single
+// source of that mode: internal/database consumes it rather than
+// keeping its own copy, so the two packages that both create the
+// directory cannot drift into disagreeing about its permissions.
+const DirPerm = 0o750
 
 // ErrLocked reports that another live process holds the data
 // directory. Callers that need to know whether a deployment is running
@@ -64,7 +66,7 @@ func Acquire(dir string) (*Lock, error) {
 		return nil, ErrNoDir
 	}
 
-	err := os.MkdirAll(dir, dirPerm)
+	err := os.MkdirAll(dir, DirPerm)
 	if err != nil {
 		return nil, fmt.Errorf(
 			"creating data directory %s: %w", dir, err,