Fixes the ephemeral MOK artifact's mode. `base-build-scratch`'s
`.mok-material` anchor minted the ephemeral key as root and wrote
`.cairn-signing/` `700` and `mok.pem`/`mok.der` `600`; on the lodestone
qemu-vm executor the artifact uploader runs as the unprivileged `build`
user, so it saw an empty directory ("found 1 matching artifact files and
directories") and both kmod jobs died on the anchor's own fail-closed
guard because `.cairn-signing/mok.pem` was never fetched. SaaS docker
executors upload as root, so the catalog's own self-test never saw it.
`base` worked around it consumer-side with an `after_script` chmod; that
workaround is no longer needed.
### Fixed
- `base-build-scratch`'s ephemeral mint role (`MOK_ROLE=mint`,
`signing_source=ephemeral`) now leaves `.cairn-signing/` `755` and
`mok.pem`/`mok.der` `644` after minting -- world-readable is
acceptable for a one-day do-not-trust throwaway with `access: none`.
The canonical key (`vars` mode, and the ephemeral consume role's
fetched copy) is unaffected and stays `700`/`600`.