fix: preserve .hb.yaml file permissions on backup and atomic write

hbd/server/configio.py

@@ -48,9 +48,12 @@ def write_config(path: str, data) -> None:
         while os.path.exists(backup_path):
             n += 1
             backup_path = f"{path}.bak.{ts}-{n}"
+        orig_mode = None
         if os.path.exists(path):
+            orig_mode = os.stat(path).st_mode
             with open(path, "rb") as src, open(backup_path, "wb") as dst:
                 dst.write(src.read())
+            os.chmod(backup_path, orig_mode)
         backups = sorted(glob.glob(f"{path}.bak.*"), reverse=True)
         for old in backups[10:]:
             os.unlink(old)
@@ -58,6 +61,8 @@ def write_config(path: str, data) -> None:
         try:
             with open(tmp, "w", encoding="utf-8") as f:
                 _make_yaml().dump(data, f)
+            if orig_mode is not None:
+                os.chmod(tmp, orig_mode)
             os.replace(tmp, path)
         except Exception:
             try: