Fix handling of read-only source file cloning

internal/infra/workspace/clone.go

@@ -37,7 +37,8 @@ func copyFile(src, dst string) error {
 	// Strip setuid/setgid/sticky — only preserve rwx permissions.
 	mode := info.Mode().Perm()
 
-	df, err := os.OpenFile(dst, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, mode)
+	// Open writable and change permissions after copy to handle read-only src.
+	df, err := os.OpenFile(dst, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o600)
 	if err != nil {
 		return fmt.Errorf("creating destination: %w", err)
 	}
@@ -48,7 +49,11 @@ func copyFile(src, dst string) error {
 	}
 
 	// Explicitly close and return any error (e.g., NFS write-back failure).
-	return df.Close()
+	if err := df.Close(); err != nil {
+		return err
+	}
+
+	return os.Chmod(dst, mode)
 }
 
 // ValidateInBounds verifies that targetPath (after resolution) is within

internal/infra/workspace/clone_linux.go

@@ -43,11 +43,16 @@ func (c *linuxCloner) tryFiclone(src, dst string) error {
 		return err
 	}
 
-	dstFile, err := os.OpenFile(dst, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, srcInfo.Mode())
+	// Open writable and change permissions after clone to handle read-only src.
+	dstFile, err := os.OpenFile(dst, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o600)
 	if err != nil {
 		return err
 	}
 	defer func() { _ = dstFile.Close() }()
 
-	return unix.IoctlFileClone(int(dstFile.Fd()), int(srcFile.Fd()))
+	if err := unix.IoctlFileClone(int(dstFile.Fd()), int(srcFile.Fd())); err != nil {
+		return err
+	}
+
+	return os.Chmod(dst, srcInfo.Mode().Perm())
 }

internal/infra/workspace/snapshot.go

@@ -148,12 +148,12 @@ func (c *FSWorkspaceCloner) CreateSnapshot(ctx context.Context, workspacePath st
 	// Always wait for workers to finish before cleanup runs, even if walk failed.
 	waitErr := g.Wait()
 
-	if err != nil {
-		return nil, fmt.Errorf("walking workspace: %w", err)
-	}
 	if waitErr != nil {
 		return nil, fmt.Errorf("cloning files: %w", waitErr)
 	}
+	if err != nil {
+		return nil, fmt.Errorf("walking workspace: %w", err)
+	}
 
 	// Write sentinel file with our PID to identify this as an active snapshot.
 	// The PID allows stale cleanup to distinguish dead-process snapshots from