[cadence 3ffd8e8f2bf6f4d4] Fix (1) checks the file owner's execute bit, not whether the installation user can execute the staged file. #243

Raised at crates/baley/src/update/deliver.rs:438 as high by openai, ruled downgraded.

Claim. Fix (1) checks the file owner's execute bit, not whether the installation user can execute the staged file.

Failure scenario. A previous sudo invocation leaves the new version's binary owned by root with mode 0744. The unprivileged updater can read it, its digest matches, and owner_runs is true, so staging accepts it and activation publishes the link. Executing the stable path then fails with EACCES because the installation user lacks execute permission.

Filed by Cadence. Fingerprint 3ffd8e8f2bf6f4d4 over (file, claim).