What permissions should wallet.dat have to be as secure as possible and still work?
The bare minimum permission would be to have it owned, and only accessible to, a user you specially create for bitcoind. At least for creation, and addition of new addresses for change, it will need to be not only readable but also writable. I am not sure if you can make it non-writable for as long as you have not exhausted the unused addresses in it.