fix(template): stop chmodding scripts the template does not own

[ichoosetoaccept]

Summary

Deletes the chmod +x scripts/*.sh scripts/*.py task from copier.yml's _tasks. Adds two tests pinning both halves of why that is safe.

Why

The task chmodded every file a downstream project keeps in scripts/, not just the one the template ships. Nine shebang-less files went 644 -> 755 on a routine 0.41.10 → 0.41.12 update, and ruff's EXE002 ("file is executable but no shebang is present") took that repo from lint-clean to nine errors — with no .rej and no warning.

The obvious recovery is a trap of its own: chmod 644 scripts/*.py clears EXE002 and raises EXE001 on the scripts that legitimately have shebangs. The real recovery is git checkout -- scripts/, which nothing points you at.

Deleted rather than narrowed, because the task was never needed. Copier's _render_file already chmods each rendered file to the template's mode — preferring the template's git-index exec bit over stat().st_mode, so a bit committed by the template author survives filesystems that do not carry one (Windows) — then syncs the destination repo's index to match. It runs on copy and update alike, and only for files copier actually renders, so a downstream scripts/probe.py is never a candidate.

Confirmed two ways: in copier 9.17.1's source (_main.py:862-907), and empirically — rendering with --skip-tasks, which never ran the chmod, already produces check-template-update.sh at 755.

That makes the template's committed file mode load-bearing, which is why there are two tests rather than one. Without test_shipped_script_is_rendered_executable, committing that file 644 would silently break check-shebang-scripts-are-executable on the first commit of every generated project.

Test plan

• test_tasks_do_not_chmod_downstream_scripts — asserts no chmod task in copier.yml.
• test_shipped_script_is_rendered_executable — asserts the rendered scripts/check-template-update.sh has the exec bit, pinning the copier behaviour now doing the work.
• Fast suite: 202 passed.

Known gap: no test exercises _tasks end-to-end — every copier invocation in the suite passes --skip-tasks, since running tasks means uv sync --upgrade (network, minutes). The first assertion is therefore structural on copier.yml text; the behavioural claim is covered by the second test plus the source reading above.

Closes DOT-628

Greptile Summary

This change removes the blanket chmod task and strengthens the regression check by parsing Copier task definitions as YAML.

The previously observed script-mode regression was exercised and disproved for this revision: a real Copier update leaves a downstream-owned shebang-less Python script at mode 0644, while the template-owned scripts/check-template-update.sh remains executable at mode 0755.

Confidence Score: 5/5

Safe to merge; no blocking failure remains.

A real Copier copy/update flow confirmed that downstream-owned scripts keep their mode and the template-owned shell script remains executable.

T-Rex Logs

What T-Rex did

• I ran a generated Bash harness with Copier 9.17.1 to create an old-template project, added downstream_owned.py at mode 0644, and ran Copier updates with tasks enabled.
• The baseline update to 0.41.14 changed the downstream-owned file to mode 0755, reproducing the former blanket-chmod behavior.
• Updating from 0.41.14 to the revision left downstream_owned.py at 0644 with no Git mode diff, and left scripts/check-template-update.sh at 0755.
• These results show that the removed task no longer changes downstream-owned script permissions while the template-owned script remains executable.
• Downstream-owned scripts remained at 0644 and the template-owned script stayed executable after the change, reproducing the baseline conditions described in the validation proof.

_{Ran code and verified through T-Rex}

_{Reviews (4): Last reviewed commit: "test: parse copier.yml as YAML in the ch..." | Re-trigger Greptile}

[linear-code]

DOT-628

[ichoosetoaccept]

This change is part of the following stack:

• fix(template): repoint sync-with-uv at the upstream project #349
  • fix(template): stop chmodding scripts the template does not own #347 ◀
    • test: tolerate copier's temp-clone cleanup race on a dirty tree #348

_{Change managed by git-spice.}