ci(hermes-agent-image): keep image file modes world-readable

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ci/Jenkinsfile.hermes-agent-image

@@ -208,6 +208,7 @@ spec:
               /busybox/printf '{"auths":{"registry.bstein.dev":{"auth":"%s"}}}\n' "${auth}" > "${config_path}"
               unset HARBOR_USER HARBOR_PASSWORD auth
               trap '/busybox/rm -f "${config_path}"' EXIT HUP INT TERM
+              umask 022
               /kaniko/executor \
                 --registry-mirror=harbor-core.harbor.svc.cluster.local \
                 --insecure-registry=harbor-core.harbor.svc.cluster.local \