posts fix

tools/fetch-posts.sh

@@ -212,6 +212,10 @@ fi
 rm -f "$LINKED"
 
 mkdir -p content
+# mktemp files are born 0600, and that mode survives rsync -a all the way to
+# production — where the server runs as another user and Caddy 403s the copy
+# in the web root. The media loop already learned this (chmod there too).
+chmod 0644 "$TMP"
 mv "$TMP" "$OUT"
 trap - EXIT
 rm -f "$RAW"