Fix desktop NetworkManager profile permissions

[Augani]

Root cause

The exact Debian desktop image was assembled successfully, then the image verifier rejected /etc/NetworkManager/system-connections/dory-wired.nmconnection because it was mode 0644. Git cannot encode owner-only 0600 for a normal tracked file, and the builder copied the overlay without re-establishing NetworkManager's private system-profile boundary.

Fix

• set the system connection profile to 0600 immediately after copying the rootfs overlay and before filesystem creation
• add a release-candidate regression contract that proves the permission step exists in the correct ordering

Verification

• desktop builder shell syntax passes
• release-candidate contract suite passes (4 tests)
• git diff --check passes
• the previous candidate advanced through the repaired AArch64 ELF verifier, built the Debian filesystem, and failed specifically at this mode assertion