Set restrictive umask (077) at startup for both TUI and Qt

ober

a56575c58e9befcf4246641efba3c5e01d1f0bdb

diff --git a/src/jerboa-emacs/app.ss b/src/jerboa-emacs/app.ss
index 8b0a275..ecdb35c 100644
--- a/src/jerboa-emacs/app.ss
+++ b/src/jerboa-emacs/app.ss
@@ -904,8 +904,13 @@
 ;;; Main entry point
 ;;;============================================================================
 
+(def ffi-umask (foreign-procedure "umask" (unsigned-32) unsigned-32))
+
 (def main
   (lambda args
+    ;; Restrict file permissions: new files are owner-only by default.
+    ;; Prevents session data (history, scratch, desktop) from being world-readable.
+    (ffi-umask #o077)
     (let ((app (app-init! args)))
       (try
         (app-run! app)
diff --git a/src/jerboa-emacs/qt/app.ss b/src/jerboa-emacs/qt/app.ss
index 4c841ec..b336909 100644
--- a/src/jerboa-emacs/qt/app.ss
+++ b/src/jerboa-emacs/qt/app.ss
@@ -1539,7 +1539,12 @@
 
       )) ;; end of qt-do-init! let* and function body
 
+(def ffi-umask (foreign-procedure "umask" (unsigned-32) unsigned-32))
+
 (def (qt-main . args)
+  ;; Restrict file permissions: new files are owner-only by default.
+  ;; Prevents session data (history, scratch, desktop) from being world-readable.
+  (ffi-umask #o077)
   ;; Pin the primordial thread to processor 0 (the main OS thread).
   ;; This is the most critical pinning: the primordial thread runs all
   ;; command dispatch, key handling, minibuffer poll loops, and Qt init.