Make Audita configuration ownership configurable

README.md

@@ -16,6 +16,10 @@ audita_manage_build_dependencies: true
 audita_go_snap_channel: 1.26/stable
 audita_go_binary: /snap/bin/go
 audita_config_path: /usr/local/etc/audita/config.yml
+audita_config_owner: root
+audita_config_group: root
+audita_config_directory_mode: "0755"
+audita_config_file_mode: "0644"
 audita_config_version: 1
 audita_pipeline_modules: null
 audita_output_schema: null
@@ -63,8 +67,12 @@ The configuration variables map directly to Audita's versioned YAML fields.
 Every optional variable defaults to `null`; null values and their empty parent
 sections are omitted, allowing Audita to retain ownership of its built-in
 defaults. `audita_config_version` always renders as `version` and defaults to
-`1`. The role writes the resulting file to `audita_config_path` as `root:root`
-mode `0644`.
+`1`. The role manages `audita_config_path | dirname` and the resulting file
+with the `audita_config_owner`, `audita_config_group`,
+`audita_config_directory_mode`, and `audita_config_file_mode` inputs. The
+standalone defaults are `root:root`, directory mode `0755`, and file mode
+`0644`. Composing roles may override these generic configuration inputs for
+their own deployment policy.
 
 LLM API-key settings name environment variables through
 `audita_llm_proposal_api_key_env` and `audita_llm_validation_api_key_env`; they