[nathan-inge]

Description of changes:

aws deploy install copied the on-premises instance configuration file to the agent's config path with shutil.copyfile. copyfile does not copy permission bits, so the destination's mode was derived from the process umask.

This change writes the destination with os.open(..., O_WRONLY | O_CREAT | O_TRUNC, 0o600) followed by an explicit
os.chmod(..., 0o600), matching the approach already used by aws deploy register. The explicit chmod also applies owner-only permissions to a file that already exists when --override-config is used.

Unchanged:

• Config directory creation and permissions.
• The copy is still skipped when the source and destination are the same path.
• Error handling: failures still raise OSError into the existing handler.

Tests:

• Fixed assset_called_with typos in the Ubuntu and Windows install tests. Because of the typos, those tests never actually asserted the copy.
• Added tests for the os.open flags and mode, the chmod on an existing file, and skipping the copy when source equals destination.
• Added POSIX real-filesystem tests (umask 022) verifying that a new file is created as 0600 and an existing 0644 file ends up 0600.

Testing:

• pytest tests/unit/customizations/codedeploy/: 131 passed
• ruff check / ruff format --check clean on changed files

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.