fix(postinst): chmod 600 the container env file

[mairas]

Motivation

Container env files at /etc/container-apps/<package>/env were created world-readable (644). They can hold secrets such as INFLUXDB_ADMIN_TOKEN, so any local process could read them without root.

Approach

templates/debian/postinst.j2: add an unconditional chmod 600 on the env file immediately after the create-if-missing block, outside the first-install guard. Because postinst configure runs on every upgrade, this both restricts fresh installs and corrects already-deployed world-readable files on upgrade.

Tests

New tests/test_env_permissions.py renders the postinst and asserts the chmod 600 is present and sits after the first-install guard's fi (locking in the upgrade-hardening intent). Confirmed failing before the change, passing after.

Verification

• Unit: 578 passed, 1 skipped
• Integration: 27 passed
• ruff check, ruff format --check, ty check: pass

Note

VERSION/debian/changelog intentionally not bumped here — version-cycle coordination across the parallel container-packaging-tools PRs is handled at merge time, so version-bump-check may show red until then.

Closes #201

[mairas]

Independent security review

Reviewed the env-permission hardening with a fresh-context security persona. The chmod 600 on env is correct and well-positioned (runs on both fresh install and every upgrade, outside the first-install guard, before any reader). One real gap and two pre-existing notes:

P1 (fixed in this PR — 1bac0f7): env.defaults was left world-readable. The sibling env.defaults is generated from default_config (which for InfluxDB holds INFLUXDB_ADMIN_PASSWORD / INFLUXDB_ADMIN_TOKEN), installed 644, and rewritten unconditionally on every configure — same secret-bearing class as env, but not covered by the original fix. The chmod 600 now covers both files, and test_env_defaults_chmod_600 asserts it. Full unit suite: 878 passed.

P2 (deferred → halos-marine-containers#184): influxdb prestart create-from-absent branch. If env is absent when the InfluxDB prestart runs, it creates the file at 644 with the rotated real token. Low likelihood (postinst always creates env first), different repo / writer, so tracked separately rather than scope-creeping this PR.

P3 (deferred → #218): create-restricted idiom. The OIDC client secret (and the env/env.defaults cp) follow create-644-then-chmod rather than install -m 600 create-restricted. Root-only same-process window, pre-existing — filed as a hardening issue.

Note: CI version-bump-check is red by design — the version-cycle bump for the parallel c-p-t PRs is coordinated at merge.