Harden generated evidence file permissions

[omar07ibrahim]

Why

The first CodeQL scan on main found high-severity alert py/overly-permissive-file: generated evidence was explicitly staged as world-readable (0644) before atomic replacement. The browser capture scripts used the same permissive temporary-output mode.

What changed

• stage Python-generated evidence owner-readable/writable only (0600) before fsync and atomic replacement
• apply the same 0600 boundary to PNG, rendered DOM, and capture-attestation staging in both browser capture scripts
• test the exact resulting mode in an isolated temporary root and assert the capture scripts contain no 0644 staging path
• document the distinction between owner-only local staging and deliberately public, synthetic committed evidence
• bind the shared evidence generator into the pack manifest's source set
• regenerate only the provenance-bound files whose source or attestation hashes changed
• remove the read-only staging workflow after its one bounded run

Committed evidence remains ordinary public Git content (100644); the hardening concerns temporary local generation before publication.

Reproducible evidence

Final head: ad69434fb70753f19fe58ab20313a91750d08cb8

• Read-only staging run: success on 57b5b551c6dd9ae37d35d2f9984d93d683a5165a
• Staging artifact 9038269447: exact 24-file inventory; every entry a regular file with mode 100600; no duplicates, symlinks, absolute paths, or traversal
• Real screenshots remained byte-identical:
  • DAG report: e539db1152e8b1d66ee543d045739851991deb2e1a45174eb4358621efd4e17e
  • pack/index report: ad1f615da03d2e0570a4b3b26603c310058964bfbc5dda201d176de8107e4d63
• 19/24 generated files were byte-identical; the five changed files are the two capture attestations, their manifests, and the DAG pipeline SVG metadata bound to the new attestation receipt

Final validation

• CI run: success on the exact final head
  • 90 tests passed
  • both checked-in evidence packages regenerated/replayed
  • Bash syntax and ShellCheck 0.9.0 passed
  • sdist and wheel built; installed wheel reproduced both verification transcripts
• CodeQL run: success
  • analysis 1591903166 on refs/pull/4/merge
  • merge-ref parents are base f9bcf2fb3d49539132700873a2aa97591b7bc8b5 and final head ad69434fb70753f19fe58ab20313a91750d08cb8
  • 0 results across 50 rules; 0 open alerts on the PR ref

History integrity

The branch is five commits ahead and zero behind main. Every branch commit has exactly one parent and both author and committer are Omar Ibrahim 31526072+omar07ibrahim@users.noreply.github.com. No force-push, squash, rebase, amend, or merge commit was used.