fix(deploy): preserve readable CA permissions when regenerating runtime

Production readiness failed because an existing private runtime certificate directory remained mode 0700 after writeRuntimeBundle reused it. The generated Redis CA files therefore could not be read by the non-root API and Agent containers. Ensure the public CA mount directories are normalized to 0755 and CA files to 0644 on every regeneration, while secret files remain 0600. Add a filesystem-mode regression test that starts from pre-existing private directories.\n\nThis is an ad-hoc production reliability fix.

Locate the writeRuntimeBundle entry point and the filesystem-mode test area. Reproduce regeneration with pre-existing private directories, then verify public CA mount directories are 0755, CA files are 0644, and secret files remain 0600 for the non-root API and Agent containers.

Written by the indexing model from the issue text.