update.zip just for fixing file permissions, possible?
Sure. Just put it in the updater-script which is usually located in META-INF/com/google/android/updater-script

Make sure your script mounts the data partition and executes something like this:

set_perm(0, 0, 0644, "/data/resource-cache/vendor@overlay@framework@framework-res.apk@idmap");

Not sure if the @ chars are not causing trouble in recovery though.

And yes, you need updater-script etc. in there.