Fix release artifact permissions across container boundaries

[LunaStev]

Summary

Fix Release #4's RISC-V and LoongArch provenance failures: root-owned archives produced inside QEMU containers retained NamedTemporaryFile mode 0600, so the host runner could not read them (EACCES). Both platform acceptance runs had completed successfully before attestation failed.

Why

Archive publication must produce a readable distribution artifact even when packaging and attestation run as different users.

Behavior

Set the completed, verified temporary archive to 0644 before its atomic replacement. A permission-setting failure preserves the previous archive and cleans up the temporary file. This applies to tar.gz and zip publication without changing archive bytes or relaxing provenance verification.

Validation

• Python release-tool suite: 38 tests passed, including restrictive-umask archive permissions and chmod failure rollback.
• Reproduced host PermissionError for a root-owned 0600 fixture; root-owned fixed RISC-V, LoongArch and ZIP archives remained readable by the non-root host, with identical bytes.
• python3 tools/repository_checks.py passed.
• Linux amd64 release build/package passed, including archive verification, executable version/help smoke and SHA256SUMS verification.
• git diff --check passed. No Rust source changes.

After merge and required master CI, dispatch a new release run from the corrected master. Re-running Release #4 would still use the old commit.