Activation script, tmpfiles, and container entrypoint now agree on 0750 for all directories. Tighten config.yaml and workspace documents from 0644 to 0640 (group-readable, no world access). Add explicit chmod for .managed marker and container $TARGET_HOME to eliminate umask dependence. Secrets (auth.json, .env) remain 0600.