fix: set the listening socket mode instead of inheriting the umask

[abienkowski]

Closes #40.

Branched off main (not stacked this time).

The bug

bind(2) on an AF_UNIX socket creates the inode with 0777 & ~umask, and none of the three implementations touched it afterwards. unix(7): connecting to a filesystem-visible socket requires write permission on it.

ambient umask	socket mode	consequence
022 (default)	0755	group has no w, so the grant the README documents silently does not work — only the owning uid can connect
000	0777	any local uid can drive the full Docker API through the proxy

With the TCP listener removed in #35, this mode is the entire access-control boundary.

Changes

--listen-socket-mode (default 0660) and --listen-socket-group (group name or gid) in all three.

• umask narrowed to 0177 around the bind, so the socket is created at 0600, then chown'd and chmod'd before the first accept. Setting the mode after bind would leave a window in which the socket is already listening at the ambient mode. Chown precedes chmod so it is never briefly reachable by the wrong group.
• World-writable modes refused at startup, exit 2. No opt-out, per the decision on the issue — it removes the boundary entirely.
• Both flags ignored for fd://3, where systemd owns the socket and SocketMode/SocketGroup are the right controls.

Verified natively, both umasks

=== umask 022 (was 0755) ===      === umask 000 (was 0777) ===
  go  -> mode 660  ping=200         go  -> mode 660  ping=200
  rs  -> mode 660  ping=200         rs  -> mode 660  ping=200
  ts  -> mode 660  ping=200         ts  -> mode 660  ping=200

Rejection paths, all three exit 2:

--listen-socket-mode=0666 -> rc=2 : world-writable
--listen-socket-mode=668  -> rc=2 : not an octal mode
--listen-socket-group=no-such-group-xyz -> rc=2 : no such group

One deliberate asymmetry

Group name lookup differs by runtime, and I could not make it uniform:

• Go — os/user.LookupGroup (NSS)
• Rust — getgrnam_r (NSS)
• TypeScript — parses /etc/group, because Node exposes no getgrnam equivalent at all

So an NSS-backed group (LDAP, SSSD) resolves in Go and Rust but not in TypeScript. The TS error message says so and points at passing a numeric gid, which works everywhere. Flagging it explicitly rather than burying it — it is the one place the three genuinely differ.

libc added to Rust for umask(2) and getgrnam_r(3), neither of which std exposes. It was already in Cargo.lock transitively via tokio, so it costs no new compile units.

Tests

Every new test was checked to fail without its fix — they report 755 under umask 022 and 777 under umask 0, reproducing the issue exactly.

	before	after	new
Go	84	93	mode applied, umask ignored, mode parsing incl. o+w, group resolution
Rust	124	128	same
TS	125	138	same, plus listen.ts umask restore and bind-failure paths
sock integration	8	12 ×3	mode is 660, owned by --listen-socket-group, not world-writable

ts/src/listen.ts is extracted from index.ts so the mode is testable at all — it was top-level module code with no export, the same problem shutdown had in #41.

Verification

• make test-all, make lint-all — pass
• make test-integration{,-rs,-ts} — 27/27 each
• make test-integration-sock{,-rs,-ts} — 12/12 each
• Native probes above

Docs

README.md corrected — it documented a grant mechanism that did not work. Now states the mode is set regardless of umask, explains why connect(2) needs write, notes that the group is what makes the mode useful, and points fd://3 users at the unit file.