<system> umask` / `--umask` is not applied to worker-created files under a foreground supervisor

### Is your feature request related to a problem? Please describe.

Follow-up from #5390, and related to #4816

Both `--umask` and ` umask` set the process umask, but the effect on worker-created files (e.g. file buffer chunks) depends on the run mode:

- `--no-supervisor` (standalone): applied — Fluentd calls `File.umask` directly in the worker.
- Supervised + `--daemon` (daemonize, e.g. fluent-package): applied — ServerEngine sets the umask before spawning workers, so workers inherit it.
- Supervised without `--daemon` (foreground): **not applied** — ServerEngine's non-daemonize path doesn't call `File.umask`, and Fluentd doesn't pass `worker_chumask`, so workers keep the inherited (shell) umask.

Verified on all three modes: a file buffer chunk created with `umask 0077` is `0600` under `--no-supervisor` and `--daemon`, but stays `0644` when running `fluentd -c fluent.conf` in the foreground.

This is existing behavior, not a regression from #5390. Opening this to decide whether to close the gap (e.g. by passing `worker_chumask` to ServerEngine so foreground workers honor the umask too) or to document it as a known limitation of the run mode.

### Describe the solution you'd like

Make `--umask` / ` umask` also apply to worker-created files under a foreground supervisor (e.g. by passing `worker_chumask` to ServerEngine so workers set their umask explicitly rather than relying on inheritance)

### Describe alternatives you've considered

If the current behavior is intentional, document the per-mode applicability instead, so foreground-supervisor users don't expect it to affect buffer file permissions.

### Additional context

_No response_

Trace how --umask and umask flow through the foreground supervisor and ServerEngine, focusing on the worker_chumask entry point and file buffer chunk creation. Compare --no-supervisor, supervised --daemon, and supervised foreground behavior, then add coverage or documentation so foreground workers either honor the configured umask or have the mode limitation explicitly recorded.

Written by the indexing model from the issue text.