fix: enforce server trust boundaries

docs/install/server-workspace-registry.md

@@ -15,7 +15,7 @@ first startup. Keep storage separated:
 /srv/thothii/data/                # settings, session data, Pi state as applicable
 /srv/thothii/workspace-registry/  # repo/, snapshots/, state/, locks/
 /srv/thothii/secrets/             # Git and connector secret files, setgid mode 2750
-/srv/thothii/operator/            # untracked Compose/.env, setgid mode 2750
+/srv/thothii/operator/            # untracked operator files, setgid mode 2770
 ```
 
 Permit outbound TCP only to approved Git/Gitea, DWH, vector, embedding, and bastion endpoints.
@@ -86,7 +86,8 @@ Variable names derive from the immutable ID: `north-star-research` becomes `NORT
 Copy [the bindings env example](examples/workspace-bindings.env.example) to the protected operator
 directory. Every path-valued `*_FILE` entry needs an absolute host-only `*_SOURCE` path. Generate
 the untracked connector override from those files during bootstrap; do not copy or maintain a
-workspace-specific Compose override.
+workspace-specific Compose override. Operator-managed path-only files use owner UID 10001, group
+`thothii-ops`, and mode `0660`; secret files remain `0640` and non-group-writable.
 
 ## Direct PostgreSQL, REST, and SSH tunnel bindings
 
@@ -163,6 +164,7 @@ Generate the connector override, then use the installation-aware operator CLI. B
 `thothctl` requires only Docker and no Go knowledge. From a trusted maintenance shell:
 
 ```sh
+umask 0007
 THT_SOURCE_ROOT=/srv/thothii/source/ThothII
 THT_OPERATOR_ENV=/srv/thothii/operator/server.env
 THT_WORKSPACE_BINDINGS_ENV_FILE=/srv/thothii/operator/workspace-bindings.env