Honor file_metadata permissions and default to 0600/0700 for local writes and remote uploads

Description

When the CLI writes rendered files locally or uploads them to a remote target, it should honor any explicit permission metadata provided in file_metadata. When no explicit mode is provided, it should default to secure permissions:

• 0600 for regular files
• 0700 for directories

This should apply consistently to both local output and remote upload flows.

Problem

Current behavior does not reliably preserve or apply file permission metadata during write/upload operations. That can lead to overly permissive files, inconsistent behavior between local and remote targets, and security regressions for secrets or executable content.

Expected Behavior

• If file_metadata specifies a permission mode for a file or directory, that mode is applied.
• If no permission mode is specified:
  • regular files default to 0600
  • directories default to 0700
• The behavior is the same whether content is written locally or uploaded to a remote destination.
• Existing templates and upload paths should continue to work without requiring new metadata.

Suggested Scope

• audit all local write paths for rendered output
• audit all remote upload paths
• define a single permission-resolution path so local and remote behavior cannot diverge
• add tests for explicit file_metadata permissions and default fallback permissions
• document the default behavior for template authors and users

Additional Information

This is effectively both a bug fix and a hardening feature: existing metadata should be respected, and the secure default should become predictable across write targets.