fix: normalize Debian payload modes

scripts/build-deb.sh

@@ -67,9 +67,9 @@ EOF
 # Native package (no Debian revision in the version), so plain changelog.gz.
 gzip -9n -c "$STAGE/changelog" > "$DOC/changelog.gz"
 
-# Normalize permissions regardless of the builder's umask: no group/other
-# write anywhere, executable entry point.
-chmod -R go-w "$PKG/usr"
+# Normalize permissions regardless of the builder's umask: traversable
+# directories, readable files, and execute bits retained only where intended.
+chmod -R u+rwX,go=rX "$PKG/usr"
 chmod 0755 "$LIB/src/cli.js"
 
 # --- control -----------------------------------------------------------------