test(config): force permission bits in perms test (umask-proof)

os.WriteFile mode is masked by umask (022 in CI turns 0666 into 0644),
making the writable-file rejection test environment-dependent; chmod the
explicit bits after write

internal/config/instance_settings_test.go

@@ -72,7 +72,8 @@ func TestInstanceSettingsPermissiveFileRejected(t *testing.T) {
 	root := t.TempDir()
 	t.Setenv("CONFIG_ROOT", root)
 	p := filepath.Join(root, "instance-settings.json")
-	_ = os.WriteFile(p, []byte(`{"settings":{"http_port":9000}}`), 0o666)
+	_ = os.WriteFile(p, []byte(`{"settings":{"http_port":9000}}`), 0o600)
+	_ = os.Chmod(p, 0o666) // 显式置位：WriteFile 的 mode 受 umask 侵蚀（CI 022 下 0666→0644）
 	if _, err := Load(""); err == nil {
 		t.Fatal("group/world writable instance settings must be rejected")
 	}