I'd be interested to know whether this work-in-progress PR to add a #:permissions argument to make-temporary-file would work for your use-case: https://github.com/racket/racket/pull/4126
You also raise a good point that the docs don't specify how with-output-to-file, open-output-port, etc. handle #:permissions when #:exists is something like 'must-truncate