fix(security): temp dir perms 0700 + macOS bash compat

- cad_runtime.py: chmod 0o777 → 0o700 for temp directories
- setup_repo.sh: replace mapfile with while-read for bash 3.2

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

gh_setup_and_patches/setup_repo.sh

@@ -186,7 +186,9 @@ setup_branch_protection() {
   # These MUST match the check names you see in PR -> Checks.
   # If you change workflow/job names, update this list.
   local -a contexts=()
-  mapfile -t contexts < <(load_required_contexts)
+  while IFS= read -r line; do
+    contexts+=("${line}")
+  done < <(load_required_contexts)
 
   # JSON array for contexts
   local contexts_json

tools/cad_runtime.py

@@ -28,7 +28,7 @@ def ensure_cad_home() -> Path:
 def create_runtime_temp_dir(prefix: str) -> Path:
     ensure_cad_home()
     path = Path(tempfile.mkdtemp(prefix=f"{prefix}-", dir=CAD_HOME))
-    os.chmod(path, 0o777)
+    os.chmod(path, 0o700)
     return path