FileManager posixPermissions effective mode across Apple SDK and Foundation on Linux

Goal: create directories and files with restrictive POSIX permissions using Foundation FileManager so other local users cannot read them by default.

The effective mode depends on both FileAttributeKey.posixPermissions and the process umask at creation time. FileProtectionKey adds runtime data protection on Apple platforms, but availability differs across macOS, iOS, iPadOS, tvOS, watchOS, and Foundation on Linux. It is unclear whether attributes apply before the item becomes visible to other processes or sync extensions, and whether callers must capture and restore umask around creation calls without affecting other threads.

Assumption: the code targets multiple deployment targets, including an Apple SDK release and a Linux Foundation port, and cannot assume identical default modes.

• Does FileManager apply posixPermissions before another process or sync extension can read the item?
• Should callers manage process umask explicitly when targeting both Apple SDKs and Foundation on Linux?
• Which FileProtectionKey values exist on each deployment target, and do they replace POSIX permissions?