fix: preserve file permissions across HF dataset sync

HF datasets strip Unix permissions, causing binaries (cursor-server,
etc) to lose execute bits after restore.

- Save exec permission manifest before upload (find -perm /111)
- Restore +x from manifest after download
- Exclude .cursor-server/.vscode-server from sync (huge, reinstallable,
caused persistent 504 timeouts on home/ uploads)
- Clean up old IDE server data from /data/

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

entrypoint.py

@@ -35,7 +35,10 @@ PIP_FILE = os.path.join(PERSIST_PATH, "pip-packages.txt")
 SYNC_DIRS = ["/home", "/root", "/usr/local", "/opt", "/var/lib", "/var/log", "/etc"]
 
 # Exclude from rsync (relative paths - rsync matches from transfer root)
-RSYNC_EXCLUDES = ["*.sock", "*.pid", "*.lock", "huggingrun.log"]
+RSYNC_EXCLUDES = [
+    "*.sock", "*.pid", "*.lock", "huggingrun.log",
+    ".cursor-server", ".vscode-server",  # IDE servers: huge, reinstallable
+]
 
 # Extra excludes only for /etc/ restore (container-managed files)
 ETC_RESTORE_EXCLUDES = [
@@ -49,7 +52,9 @@ UPLOAD_IGNORE = [
     "__pycache__", "*.pyc", ".git", ".git*",
     "*.sock", "*.lock", ".huggingface", ".cache",
     "huggingrun.env",       # contains HF_TOKEN
+    ".cursor-server", ".vscode-server",
 ]
+EXEC_MANIFEST = os.path.join(PERSIST_PATH, "exec-manifest.txt")
 
 
 # -- Logging -----------------------------------------------------------
@@ -190,6 +195,21 @@ def restore():
             else:
                 log(f"  some pip packages failed")
 
+    # Restore execute permissions from manifest (HF dataset strips them)
+    manifest = os.path.join(PERSIST_PATH, "exec-manifest.txt")
+    if os.path.exists(manifest):
+        count = 0
+        with open(manifest) as f:
+            for line in f:
+                path = line.strip()
+                if path and os.path.exists(path):
+                    try:
+                        os.chmod(path, os.stat(path).st_mode | 0o111)
+                        count += 1
+                    except Exception:
+                        pass
+        log(f"  restored +x on {count} files")
+
     # Fix SSH key permissions (HF dataset doesn't preserve permissions)
     sh("chmod 600 /etc/ssh/ssh_host_*_key 2>/dev/null")
     sh("chmod 644 /etc/ssh/ssh_host_*_key.pub 2>/dev/null")
@@ -250,10 +270,26 @@ def save_and_upload():
         cmd = f"rsync -rlptD --delete {excludes} '{d}/' '{dst}/'"
         sh(cmd)
 
-    # Clean .cache dirs (HF API rejects .cache paths)
+    # Save executable file manifest (HF dataset strips permissions)
+    exec_files = []
+    for d in SYNC_DIRS:
+        dst = os.path.join(PERSIST_PATH, d.lstrip("/"))
+        if os.path.isdir(dst):
+            rc, out = sh(f"find '{dst}' -type f -perm /111 2>/dev/null")
+            if rc == 0 and out:
+                for p in out.strip().split('\n'):
+                    p = p.strip()
+                    if p.startswith(PERSIST_PATH):
+                        exec_files.append('/' + p[len(PERSIST_PATH):].lstrip('/'))
+    if exec_files:
+        with open(EXEC_MANIFEST, "w") as f:
+            f.write('\n'.join(exec_files) + '\n')
+        log(f"  saved {len(exec_files)} executable paths")
+
+    # Clean dirs that should not be uploaded
     for dirpath, dirnames, _ in os.walk(PERSIST_PATH):
         for dn in list(dirnames):
-            if dn == ".cache":
+            if dn in (".cache", ".cursor-server", ".vscode-server"):
                 shutil.rmtree(os.path.join(dirpath, dn), ignore_errors=True)
                 dirnames.remove(dn)
 
@@ -264,7 +300,8 @@ def save_and_upload():
     fail = 0
 
     # Upload package list files + log
-    for pf, name in [(PKG_FILE, "user-packages.list"), (PIP_FILE, "pip-packages.txt"), (LOGFILE, "huggingrun.log")]:
+    for pf, name in [(PKG_FILE, "user-packages.list"), (PIP_FILE, "pip-packages.txt"),
+                     (EXEC_MANIFEST, "exec-manifest.txt"), (LOGFILE, "huggingrun.log")]:
         if os.path.exists(pf):
             try:
                 api.upload_file(