Fix dist root permissions so --sync publishes a readable directory

The dist directory is the swapped-in staging dir, which mktemp -d creates mode
0700. The published album root therefore stayed 0700, so the first `shuriken
--sync` created the remote album directory 0700 and the web server (daemon) could
not read it -- requiring a manual chmod 755 on each mirror.

Relax the staging dir to the umask-default directory mode right after mktemp -d
(what mkdir would have produced), so the dist root matches its subdirectories and
is served/synced with sane permissions. Add a regression test asserting the dist
root mode equals its photos/ subdirectory mode.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 7 insertions, 0 deletions

diff --git a/tests/cli.sh b/tests/cli.sh
index a435e58..aa869cc 100755
--- a/tests/cli.sh
+++ b/tests/cli.sh
@@ -2776,6 +2776,13 @@ test_integration_generates_album_outputs_and_cleans() {
     test::assert_file_exists "$TEST_TMPDIR/dist/shuriken.json"
     test::assert_no_html_subdir_output "$TEST_TMPDIR/dist"
 
+    # The published dist root must carry the same (umask-default) permissions as
+    # its mkdir-created subdirectories, not the 0700 the mktemp staging dir starts
+    # with -- otherwise `--sync` creates the remote album dir 0700 and the web
+    # server cannot read it.
+    test "$(stat -c '%a' "$TEST_TMPDIR/dist")" \
+        = "$(stat -c '%a' "$TEST_TMPDIR/dist/photos")"
+
     page_html=$(<"$TEST_TMPDIR/dist/page-1.html")
     details_html=$(<"$TEST_TMPDIR/dist/1-1-details.html")
     top_index_html=$(<"$TEST_TMPDIR/dist/index.html")