The bootstrap Secret mounts read-only (defaultMode: 0400), and the
init container's plain `cp` was propagating that mode into the
libation-config PVC. Result: LibationCli failed on the first scan
with "Libation cannot write its SQLite database (migrations need
write access)" against /config-internal/LibationContext.db.
`install -m 660` sets owner+group rw explicitly; fsGroup 1000 already
gives every container gid 1000, so 0660 is enough for the libation
container to update both AccountsSettings.json (token refresh) and
LibationContext.db (library state) across runs.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
k.rennerandClaude Opus 4.7
e7c02bbbed