posts fix

tools/fetch-media.sh

@@ -150,6 +150,9 @@ if jq --slurpfile map "$MAP" '
           else . + { poster: (($m[.poster].path) // .poster) }
           end)))
     ' "$POSTS" > "$TMP_POSTS" 2>/dev/null; then
+    # Same reason as the chmod on each mirrored file: mktemp is 0600 and the
+    # mode survives to production, where other users must read this.
+    chmod 0644 "$TMP_POSTS"
     mv "$TMP_POSTS" "$POSTS"
 else
     rm -f "$TMP_POSTS"