fix: create abcd's home private to the account whichever command runs first

[REPPL]

Fixes iss-2610032205304585: abcd's home folder was created 0700 by some writers and 0755 by others, the hook's bootstrap included, so whichever command ran first decided whether other accounts on the computer could list it.

What changes

• internal/abcdhome gains DirMode (0700) and FileMode (0600).
  • Every writer that can create the home or a folder in it hands abcdhome.DirMode: the eight fsutil.EnsureHomeScope writers, the EnsureRealDir(All) writers whose base is the home, and the voyage, transcript, worktree and lab stores' mode constants.
  • The transcript store creates the home on its own, where the scan can judge it.
• hooks/bootstrap.sh creates the home with mkdir -p -m 0700, for the cache attestation and the path-entry refresh.
  • It sets both path-entry writes to 0600 before moving them into place.
  • The plugin_root re-stamp's temp comes from an in-directory mktemp, as the attestation's does, rather than a predictable name.
• The path-entry record and the registry's index are written 0600.
  • The index no longer keeps its earlier mode, so one an earlier version wrote 0644 is narrowed at its next write.
• An existing home keeps its mode, as every home-scope writer's contract says. The residual, recorded in DECISIONS.md, is that other accounts can list an old 0755 home's names, never read a record in it.
• The ahoy brief chapter states the home's mode.

Tests

Each test below was watched fail first:

• TestEveryHomeWriterMakesTheHomePrivate: an AST scan of every folder-creating call whose base is the home, failing below a floor of the 14 writers it judges. Its armed twin is TestHomeModeScannerIsArmed.
• TestHomeWritersMakeTheHomePrivate: 755/644 before the fix.
• TestBootstrapMakesTheHomePrivate: 755/644 before the fix.
• TestAnEarlierIndexIsNarrowedAtItsNextWrite.

Planted regressions on scratch copies each fail the scan, naming file and line: a store constant widened to 0755, a home-led MkdirAll at 0755, and the transcript store's home created at 0755.

Review

Two security reviews (Fable).

• First pass: NEEDS_WORK.
  • The scanner could not see four store writers.
  • Existing installs kept their 0644 records.
  • The re-stamp temp had a predictable name.
• Re-verification: closed all of these but one, the transcript store's home created inside a loop the scan could not judge. That is fixed here, with the scan's floor pinned to the measured count.

Lands before #815 (noindex steps 3-4), which touches the same files and merges this in.

Resolves: iss-2610032205304585

Assisted-by: Claude:claude-opus-5-5