fix: set script modes in the image independent of the build umask

COPY --chmod=755 for backup.sh, check.sh and entry.sh. Restore the exact
-rwxr-xr-x checks in tests/structure.yml and drop the umask workaround in
tests/sabotage.py.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/sabotage.py

@@ -54,10 +54,6 @@ def sabotage_tree(tmp: Path) -> None:
     if patched == lines:
         raise Invalid("sabotage patch did not apply, backup.sh changed shape")
     script.write_text("".join(patched))
-    # Dockerfile COPY has no chmod: the image only works when the file is executable.
-    script.chmod(script.stat().st_mode | 0o111)
-    if not os.access(script, os.X_OK):
-        raise Invalid("sabotaged backup.sh is not executable")
 
 
 def red_tests(report: Path) -> tuple[set[str], set[str]]:

tests/structure.yml

@@ -34,15 +34,15 @@ fileExistenceTests:
   - name: 'backup script'
     path: '/bin/backup'
     shouldExist: true
-    isExecutableBy: 'other'
+    permissions: '-rwxr-xr-x'
   - name: 'check script'
     path: '/bin/check'
     shouldExist: true
-    isExecutableBy: 'other'
+    permissions: '-rwxr-xr-x'
   - name: 'entrypoint'
     path: '/entry.sh'
     shouldExist: true
-    isExecutableBy: 'other'
+    permissions: '-rwxr-xr-x'
   - name: 'default repository mount point'
     path: '/mnt/restic'
     shouldExist: true