Keep distribution staging owner-only

[omar07ibrahim]

What changed

• keeps source snapshots, materialized canonical sdist trees, and temporary archive outputs owner-only on disk
• preserves public 0644/0755 modes only as deterministic wheel/sdist member metadata
• adds regression coverage for both source-snapshot and canonical-sdist materialization permissions
• adopts the exact source-bound evidence candidate generated by the read-only hosted workflow

Security result

Extended CodeQL opened seven high-severity overly-permissive-file findings on main. The PR merge ref now has zero open code-scanning alerts, with no dismissals.

Reproducible evidence

Run 31384813643 recaptured the full 28-file evidence bundle and verified the drift allowlist before uploading artifact 9061461067 without repository write permission. Independent review checked all 39 source hashes, every artifact byte count and SHA-256, image/SVG structure, modes, paths, and secret/host markers.

Only three candidate files differ: the real quality-gate transcript now reports 317 passing tests, its actual PNG render is updated, and the manifest advances those identities plus the four changed source/test hashes. All other 25 evidence files are byte-identical to the branch.

This PR does not choose a license or publish a release; that separate rights-owner decision remains tracked in issue #9.