fix(archsetup): tighten /efi mount permissions in fstab

archinstall writes the /efi line to /etc/fstab with `defaults` (or similar) and no fmask/dmask, so files inside end up 0755. Kernel images, initramfs, and bootloader config are world-readable on a freshly installed system. On a single-user machine that's mild, but there's no good reason to leave it that way.

I added a guarded sed to boot_ux() that appends `fmask=0177,dmask=0077` to the /efi vfat line. Files end up 0600 and dirs 0700, root-only. The block is idempotent. Both guards check that the /efi line exists and that fmask= isn't already there before touching anything. I patched this machine's fstab the same way, so the new options take effect on next boot.

0 files changed, 0 insertions, 0 deletions