Preserve original file permission mode in atomic --fix/--write writes

[dean0x]

Location: crates/mds-cli/src/lint.rs:307 atomic_write_file

Tempfile is created 0600 and renamed over the target, so --fix can make a group/world-readable template owner-only.

Deferred From: PR #171 (Closes #61) — mds lint release gate
Review: .devflow/docs/reviews/feat-mds-lint-61/2026-07-11_1046/resolution-summary.md

Reason for Deferral:
Not a leak (more restrictive is more secure), and consistent with mds fmt's identical write path. Optional hardening best done as unified change across both lint and fmt, post-release.

Acceptance Criteria:

• Read original file permissions via fs::metadata
• Apply same permissions to tempfile before rename
• Update both lint.rs and fmt.rs atomic_write_file paths
• Add test for mode preservation