code-generation 0.35.0 resulting in permission denied errors

### What happened?

I am working on an extension apiservers and a library helping to create those, upgrading k8s depdendencies to 0.35.0 breaks code generation.

The `kube::codegen::gen_openapi` command from `kube_codegen.sh` reports several permission denied errors, e.g.:
```
Generating deepcopy code for 2 targets
Generating defaulter code for 1 targets
Generating conversion code for 1 targets
Generating openapi code for 1 targets
2026/01/17 17:40:09 Model name code generation error: failed executing generator: some targets had errors: errors in target "k8s.io/apimachinery/pkg/api/resource": open /home/nik/Development/ace/apiserver-kit/.devenv/state/go/pkg/mod/k8s.io/apimachinery@v0.35.0/pkg/api/resource/zz_generated.model_name.go: permission denied
errors in target "k8s.io/apimachinery/pkg/apis/meta/v1": open /home/nik/Development/ace/apiserver-kit/.devenv/state/go/pkg/mod/k8s.io/apimachinery@v0.35.0/pkg/apis/meta/v1/zz_generated.model_name.go: permission denied
errors in target "k8s.io/apimachinery/pkg/runtime": open /home/nik/Development/ace/apiserver-kit/.devenv/state/go/pkg/mod/k8s.io/apimachinery@v0.35.0/pkg/runtime/zz_generated.model_name.go: permission denied
...
```

It is possible to work around these issues by setting the permissions in go modules to non-readonly:
```
declare -a GOMODS=(
"k8s.io/apimachinery"
"k8s.io/api"
)
echo "Setting permissions for files of relevant go modules to 644"
for MOD in "${GOMODS[@]}"; do
find "$(go list -json -m -u "${MOD}" | jq -r '.Dir')" -type f -exec chmod 644 -- {} +
done
```
However tampering with the go modules will make `go mod verify` fail and changing the permissions back will not solve this as the computed hashes differ, so the relevant modules have to be force deleted afterwards to fix this.

### What did you expect to happen?

No errors were expected to occur.

### How can we reproduce it (as minimally and precisely as possible)?

An easy way to reproduce this is to:
```
git@github.com:kubernetes/sample-apiserver.git
cd sample-apiserver
vim hack/update-codegen.sh # update L22 to: 'CODEGEN_PKG=$(go list -m -f '{{.Dir}}' k8s.io/code-generator)'
go mod download
./hack/update-codegen.sh
```

### Anything else we need to know?

This worked in prior versions, so I am wondering if the files are not opened as read-only.

### Kubernetes version

k8s.io/api v0.35.0
k8s.io/apimachinery v0.35.0
k8s.io/apiserver v0.35.0
k8s.io/client-go v0.35.0
k8s.io/code-generator v0.35.0
k8s.io/component-base v0.35.0
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
k8s.io/utils v0.0.0-20260106112306-0fe9cd71b2f8

### Cloud provider

### OS version

```console
# On Linux:
$ cat /etc/os-release
ANSI_COLOR="0;38;2;126;186;228"
BUG_REPORT_URL="https://github.com/NixOS/nixpkgs/issues"
BUILD_ID="25.11.20251204.c97c47f"
CPE_NAME="cpe:/o:nixos:nixos:25.11"
DEFAULT_HOSTNAME=nixos
DOCUMENTATION_URL="https://nixos.org/learn.html"
HOME_URL="https://nixos.org/"
ID=nixos
ID_LIKE=""
IMAGE_ID=""
IMAGE_VERSION=""
LOGO="nix-snowflake"
NAME=NixOS
PRETTY_NAME="NixOS 25.11 (Xantusia)"
SUPPORT_END="2026-06-30"
SUPPORT_URL="https://nixos.org/community.html"
VARIANT=""
VARIANT_ID=""
VENDOR_NAME=NixOS
VENDOR_URL="https://nixos.org/"
VERSION="25.11 (Xantusia)"
VERSION_CODENAME=xantusia
VERSION_ID="25.11
$ uname -a
Linux fw13 6.18.0 #1-NixOS SMP PREEMPT_DYNAMIC Sun Nov 30 22:42:10 UTC 2025 x86_64 GNU/Linux

```

### Install tools

### Container runtime (CRI) and version (if applicable)

### Related plugins (CNI, CSI, ...) and versions (if applicable)

Start with hack/update-codegen.sh and the kube::codegen::gen_openapi command, reproducing against the sample-apiserver steps with the v0.35.0 modules. Compare the generated-file permissions and module behavior with prior versions; done means code generation completes without permission-denied errors while preserving module verification.

Written by the indexing model from the issue text.