fix: tighten file permissions on downloads and backups

[merv-nexura]

Summary

Tightens permissions on files and directories that contain Claude config:

• internal/sync/sync.go — files written by Pull are now 0600 (was 0644); the parent directory created on demand is 0700 (was 0755).
• cmd/claude-sync/main.go — the ~/.claude.backup.<ts> directory created during a first-pull-with-existing-files flow, its nested subdirectories, and the files copied into it now use 0700/0700/0600 (was 0755/0755/0644).

This addresses L2 and L3 in SECURITY-AUDIT.md. Claude config may contain API keys, prompts, and personal context; world-readable permissions allowed any other user with read access to the home directory — or any process running on the box — to read it. The encryption key file at ~/.claude-sync/age-key.txt is already 0600, and the config dir is already 0700, so this brings the synced/backed-up data in line with that posture.

Self-update at cmd/claude-sync/main.go:1694 (which writes the new binary as 0755) is intentionally not changed — it's an executable.

Tests

• internal/sync.TestPullSetsRestrictivePermissions — pulls a remote file at a nested path (agents/helper.json.age) so the pull has to create the parent directory, then asserts Mode().Perm() is exactly 0600 for the file and 0700 for the directory. (Nested path is required because os.MkdirAll does not modify the mode of pre-existing directories.)
• cmd/claude-sync.TestCreateBackupSetsRestrictivePermissions — calls createBackup() directly with HOME swapped to a tempdir, asserts backup root, nested subdir, and copied file are 0700/0700/0600.

Both tests pass; full `go test ./...` is green.

Test plan

• `make check` (gofmt, go vet, `go test ./... -short`)
• `go test ./...`
• CI green on PR

Note

This is the first of a planned series of small focused PRs to address findings in `SECURITY-AUDIT.md`.