ci: set umask 022 to prevent group-writable cache dirs (sr.ht default umask creates 0775 dirs)

ober

bea2db2d2d784d9e32664962658b8a1a279d8276

diff --git a/.build.yml b/.build.yml
index 98630b7..1d8267a 100644
--- a/.build.yml
+++ b/.build.yml
@@ -38,6 +38,7 @@ artifacts:
   - jerboa-browser/gui-snapshots.tar.gz
 tasks:
   - fetch-jerboa: |
+      umask 022
       # Dependency source is fetched at the consumer-owned commit/tree lock;
       # SourceHut's sources list otherwise follows a mutable repository head.
       mkdir jerboa