Harden self-update extraction temp handling

[ryanfowler]

Summary

• Create a private, drop-cleaned temp directory for self-update extraction
• Mask tar permission bits before applying extracted file modes
• Add unit coverage for temp cleanup, Unix directory permissions, and tar mode masking

Testing

• cargo fmt
• cargo clippy --locked --all-targets --all-features -- -D warnings
• cargo test --all-features
• cargo test --all-features --test cli --test formatting --test grpc --test http --test network --test terminal --test update --test websocket -- --test-threads=1