cmds.secrets.CompileTemplates: Fix conf line handling

File attributes of the compiled output of "jw-pkg secrets
compile-templates" can be specified via the # conf line atop a .jw-tmpl
file, the parsing of that line is buggy, however.

Its mode is parsed as a decimal number unless it carries a leading zero, so
"mode=640" yields 640 decimal, 1200 octal, and the output file ends up
without usable permissions.  The same decimal parse applies to a conf line atop
the .jw-secret of a target, whose attributes are honored the same way, and
the --mode option of compile-templates passes its string value through to
Attrs, whose mode is typed int, so a target without a conf line of its own
crashes in _format_metadata().

Other than that, the # conf line itself should be removed from the compiled
output, but isn't.

This commit makes the conf line handling correct:

- _parse_attributes() parses the mode as octal, with or without a leading
  zero
- _compile_one_template_file() drops the conf line from the compiled
  content
- the --mode option is converted to an octal int by octal_mode() at the
  argument boundary

The integration test writes its conf line modes without leading zeros,
expects the conf line gone from the compiled output, takes one target's
mode from a conf line atop its .jw-secret, and passes a --mode that the
conf lines override.

Assisted-by: unsloth/Qwen3.8-27B-GGUF:Q4_K_M with pi.dev v1.1.0
Signed-off-by: Jan Lindemann <jan@janware.com>

test/integration/jw-pkg/help/test-expected.txt

@@ -846,7 +846,7 @@ options:
   -h, --help         show this help message and exit
   --owner, -o OWNER  Default output file owner (default: None)
   --group, -g GROUP  Default output file group (default: None)
-  --mode, -m MODE    Default output file mode (default: None)
+  --mode, -m MODE    Default output file mode (octal) (default: None)
 ============= Running: jw-pkg.py -t ../../../.. --log-level info secrets install --help
 usage: jw-pkg.py secrets install [-h] [--only-missing] src [packages ...]
 

test/integration/jw-pkg/secrets/runme.py

@@ -175,7 +175,7 @@ def main() -> None:
         os.makedirs(target + '/etc')
         with open(target + '/etc/foo.conf.jw-tmpl', 'w') as f:
             f.write(
-                f'# conf: owner={USER}, group={GROUP}, mode=0640\n'
+                f'# conf: owner={USER}, group={GROUP}, mode=640\n'
                 'host=HOSTNAME\n'
                 'token=TOKEN\n'
             )
@@ -297,8 +297,15 @@ def main() -> None:
             assert not os.path.exists(baz_secret)
             assert stat.S_IMODE(os.stat(foo_secret).st_mode) == 0o400
 
-        # -- compile-templates: substitute the keys, apply the metadata
+        # -- The file attributes can also be specified atop the
+        #    .jw-secret; bar takes its mode from there
+        os.unlink(bar_secret)
+        with open(bar_secret, 'w') as f:
+            f.write(f'# conf: owner={USER}, group={GROUP}, mode=640\n')
+            f.write('PLAIN=plain-value\n')
 
+        # -- compile-templates: substitute the keys, apply the
+        #    metadata; the conf lines win over the --mode default
         out, _ = run_cli(
             distro, [
                 'secrets',
@@ -307,6 +314,8 @@ def main() -> None:
                 USER,
                 '--group',
                 GROUP,
+                '--mode',
+                '400',
                 PKG,
             ]
         )
@@ -314,13 +323,10 @@ def main() -> None:
         st = os.stat(foo_out)
         assert (st.st_uid, stat.S_IMODE(st.st_mode)) == (os.getuid(), 0o640), st
         with open(foo_out) as f:
-            assert f.read() == (
-                f'# conf: owner={USER}, group={GROUP}, mode=0640\n'
-                'host=jannet\n'
-                'token=host-token\n'
-            )
+            assert f.read() == ('host=jannet\n'
+                                'token=host-token\n')
         st = os.stat(bar_out)
-        assert (st.st_uid, stat.S_IMODE(st.st_mode)) == (os.getuid(), 0o400), st
+        assert (st.st_uid, stat.S_IMODE(st.st_mode)) == (os.getuid(), 0o640), st
         with open(bar_out) as f:
             assert f.read() == 'plain=plain-value\n'
 
@@ -334,16 +340,15 @@ def main() -> None:
                 USER,
                 '--group',
                 GROUP,
+                '--mode',
+                '400',
                 PKG,
             ]
         )
         assert out == [], out
         with open(foo_out) as f:
-            assert f.read() == (
-                f'# conf: owner={USER}, group={GROUP}, mode=0640\n'
-                'host=jannet\n'
-                'token=host-token\n'
-            )
+            assert f.read() == ('host=jannet\n'
+                                'token=host-token\n')
         with open(bar_out) as f:
             assert f.read() == 'plain=plain-value\n'