Fix umask handling in bin linking

- Change `umask | 0o777` to `0o777 & ~umask` for correct permission calculation
- Make `ensureUmask` restore the original umask instead of leaving it at zero

Co-authored-by: Jarred-Sumner <Jarred-Sumner@users.noreply.github.com>

src/install/bin.zig

@@ -581,13 +581,16 @@ pub const Bin = extern struct {
         err: ?anyerror = null,
 
         pub var umask: bun.Mode = 0;
+        var original_umask: bun.Mode = 0;
 
         var has_set_umask = false;
 
         pub fn ensureUmask() void {
             if (!has_set_umask) {
                 has_set_umask = true;
-                umask = bun.sys.umask(0);
+                original_umask = bun.sys.umask(0);
+                umask = original_umask;
+                _ = bun.sys.umask(original_umask);
             }
         }
 
@@ -762,7 +765,16 @@ pub const Bin = extern struct {
         fn createSymlink(this: *Linker, abs_target: [:0]const u8, abs_dest: [:0]const u8, global: bool) void {
             defer {
                 if (this.err == null) {
-                    _ = bun.sys.chmod(abs_target, umask | 0o777);
+                    // An extra stat() is cheaper than a copy-up of potentially large executables in Docker.
+                    switch (bun.sys.stat(abs_target)) {
+                        .result => |*stat| {
+                            const desired_mode = 0o777 & ~umask;
+                            if ((stat.mode & 0o777) != desired_mode) {
+                                _ = bun.sys.chmod(abs_target, desired_mode);
+                            }
+                        },
+                        .err => {},
+                    }
                 }
             }