fix: guard builder plugin command umask on group-writable hosts

[rldyourmnd]

Problem

run_builder_plugin_command spawned the Codex CLI without an os.umask guard, unlike its sibling run_verified_installer. On hosts whose ambient umask is 0002 (the Ubuntu default, unlike macOS 022) the child inherited that umask and created plugins/, cache/, marketplace/, and the cached plugin manifest with group-writable modes (0775/0664).

The builder cache validators reject any entry with mode & 0o022, so install-builder failed closed on Ubuntu desktops:

nddev-codex: error: install-builder failed and configuration/cache rollback also failed: CodexSetupError: Codex plugin directory must not be writable by group or others

Fix

Wrap the Popen in os.umask(0o077)/restore, mirroring run_verified_installer (lines 3353-3365). This is the only unguarded Popen call site in the module (audit confirmed exactly 2 Popen calls; the other is already guarded).

Tests

Added tests/test_umask_guard.py (3 cases, all passing):

• test_guard_restores_prior_umask — the guard sets the effective mask to 0o077 and restores the ambient umask afterward, even under umask 0002.
• test_child_dirs_are_not_group_writable_under_guard — a child mimicking the Codex CLI's directory creation cannot produce group-writable entries while the guard is active.
• test_source_has_the_guard — static guard: the umask pair appears in both run_verified_installer and run_builder_plugin_command.

Run with: uv run --with pytest pytest tests/test_umask_guard.py -v

Verification

Tested on rldyourmnd-ubuntu-1 (Ubuntu 26.04 x86_64, umask 0002): install-builder succeeds after this fix; the previously-failing validator path now passes.

Notes

• File mode bits in the repo are already canonical (git ls-files shows all 100644); the on-disk 664/775 is purely a local-checkout artifact of umask 0002 and is exactly what the guard prevents the child from reproducing. No chmod/.gitattributes change is needed.
• This was discovered during the first concrete Linux device bootstrap (GDS rldyourmnd-ubuntu-1).