fix: strip world-writable bit; add --allow-world-writable flag

[bug-ops]

Fixes #84.

Summary

• World-writable files (mode 0o777) aborted extraction with an error, while setuid/setgid bits were silently stripped — inconsistent behavior
• Strip the world-writable bit (0o002) by default, consistent with existing setuid/setgid stripping
• Add --allow-world-writable CLI flag and allow_world_writable: bool in SecurityConfig.allowed for explicit opt-in

Changes

• crates/exarch-core/src/security/permissions.rs: replace Err(InvalidPermissions) with sanitized &= !0o002 strip; add test_world_writable_allowed_with_config, test_world_writable_stripped_by_default, test_world_writable_bit_only_stripped
• crates/exarch-cli/src/cli.rs: add --allow-world-writable flag to ExtractArgs
• crates/exarch-cli/src/commands/extract.rs: wire flag to allowed.world_writable
• CHANGELOG.md: document fix and new flag under [Unreleased]

Test plan

• cargo +nightly fmt --all -- --check passes
• cargo clippy --all-targets --all-features --workspace -- -D warnings passes
• cargo nextest run --workspace --all-features --exclude exarch-python --exclude exarch-node --lib --bins — 516 tests pass
• Existing tests updated: test_sanitize_permissions_strip_world_writable now asserts Ok(0o775) instead of error
• New tests: allow_world_writable = true preserves bit; 0o666 → 0o664 (only other-write stripped)