Create private evidence directories safely on fsGroup volumes

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

informed_decision/container.py

@@ -23,7 +23,20 @@ def private_directory(path):
     path = Path(path)
     if not path.is_absolute():
         raise ValueError("absolute private directory required")
-    path.mkdir(mode=0o700, exist_ok=True)
+    try:
+        path.mkdir(mode=0o700)
+    except FileExistsError:
+        pass
+    else:
+        # Kubernetes fsGroup volumes make newly created children inherit setgid.
+        # Normalize only this new owned directory; never take over existing data.
+        fd = os.open(path, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW)
+        try:
+            info = os.fstat(fd)
+            if info.st_uid == os.getuid() and stat.S_IMODE(info.st_mode) == 0o2700:
+                os.fchmod(fd, 0o700)
+        finally:
+            os.close(fd)
     info = path.lstat()
     if (not stat.S_ISDIR(info.st_mode) or info.st_uid != os.getuid()
             or stat.S_IMODE(info.st_mode) != 0o700):