posts fix

tools/fetch-media.sh

@@ -150,6 +150,9 @@ if jq --slurpfile map "$MAP" '
           else . + { poster: (($m[.poster].path) // .poster) }
           end)))
     ' "$POSTS" > "$TMP_POSTS" 2>/dev/null; then
+    # Same reason as the chmod on each mirrored file: mktemp is 0600 and the
+    # mode survives to production, where other users must read this.
+    chmod 0644 "$TMP_POSTS"
     mv "$TMP_POSTS" "$POSTS"
 else
     rm -f "$TMP_POSTS"

tools/fetch-posts.sh

@@ -212,6 +212,10 @@ fi
 rm -f "$LINKED"
 
 mkdir -p content
+# mktemp files are born 0600, and that mode survives rsync -a all the way to
+# production — where the server runs as another user and Caddy 403s the copy
+# in the web root. The media loop already learned this (chmod there too).
+chmod 0644 "$TMP"
 mv "$TMP" "$OUT"
 trap - EXIT
 rm -f "$RAW"