ww build: honor Go output permission modes

docs/spec.md

@@ -310,6 +310,15 @@ ImportPath    = ident { "." ident } .
   `fn main`; path and directory spelling do not classify commands. An ordinary
   import of a package declared `main` is rejected, except for the toolchain's
   colocated external-test wiring.
+- A newly published `ww build` command is created with permission `0777`
+  filtered by the invoking process's umask. A newly published non-command
+  archive, and the adjacent WW interface required to consume it, use `0666`
+  filtered by that same umask. These inode permissions are output metadata:
+  they do not enter canonical package or action identity, artifact bytes,
+  import binding, symbols, `.wwi` contents, or persistent invalidation. A warm
+  build therefore reuses unchanged semantic actions while refreshing the
+  caller-visible output with the current invocation's mode. Assembly-only
+  builds publish no executable or archive.
 - Only names marked `export` (§5) are visible across module boundaries.
 
 Import paths remain unquoted and dotted. Grouped imports, quoted import paths,