feat(edh-keygen): configure shared DH parameter permissions

Add configurable ownership and permission defaults for shared DH
parameter directories and files.

Set shared DH parameter defaults to root:root, directory mode 0755, and file
mode 0644 so non-root TLS services can traverse the directory and read DH
parameter files.

Enforce configured ownership and modes after synchronization and document the
security boundary between public DH parameters and TLS private keys.

CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## Unreleased
+
+### Added
+
+- Added configurable ownership and permission defaults for the shared DH parameter directory and generated DH parameter files through `tls_private_owner`, `tls_private_dir_mode`, and `tls_private_file_mode`.
+- Added configuration documentation for shared DH parameter access and for the distinction between DH parameters and TLS private keys.
+- Added deterministic ownership and permission enforcement for the shared DH parameter directory and `dh_*.pem` files.
+
+### Changed
+
+- Changed the default shared DH parameter directory ownership and mode to `root:root` and `0755`.
+- Changed the default shared DH parameter file ownership and mode to `root:root` and `0644`.
+- Changed the shared DH parameter defaults to allow non-root TLS services to traverse the directory and read DH parameter files.
+- Changed global DH parameter synchronization to apply the configured ownership and file mode after transfer.
+
 ## 1.0.0 - 2026-09-06
 
 ### Added