fix(coredns): render the Corefile readable to the container user

mkstemp creates its file 0600 and Path.replace carries that mode into the target, so every freshly rendered Corefile was owner-only while coredns runs as nonroot. The container exits with 'open /Corefile: permission denied', name resolution dies for the whole stack, and deploys then fail at whatever they try to fetch first.

Long-running stacks hid it: coredns reads its config once at startup, so a container created before a re-render keeps working. Only new worktree stacks broke.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit efc281e327)

cli/administration/deploy/development/coredns.py

@@ -143,6 +143,7 @@ class CoreDNSCorefileRenderer:
         if size == 0:
             raise RuntimeError(f"Rendered Corefile is empty: {tmp_file}")
 
+        tmp_file.chmod(0o644)
         tmp_file.replace(out_file)
         self._log(f"Rendered successfully ({size} bytes)")