The first publish on phishing.pezkuwichain.io copied the stage directory's
0700 mode onto the web root with rsync -a, and every list answered 403 until
the modes were put back by hand, about three minutes later. The publish script
now sets modes (--chmod=D755,F644), and test-publish.sh checks the web root's
directories are 755 and the lists 644; without --chmod it fails.
master is now protected by a ruleset (pull request, "lists" required). GitHub
refuses the Actions app as a bypass actor, so the sync's github.token push
would have been rejected. The sync now pushes over a write deploy key, the
repository's only one, kept as a secret of a "sync" environment that runs for
master only; the ruleset exempts deploy keys. GitHub's host keys are pinned
in pezkuwi/github_host_keys, and the job's token drops to contents: read.
