fix: extract embedded bundle with private permissions

ober

c109e3129996afa90705e0bcef72f46cc82c7705

diff --git a/support/multicall-main.c b/support/multicall-main.c
index 27b47e3..d69d542 100644
--- a/support/multicall-main.c
+++ b/support/multicall-main.c
@@ -264,6 +264,9 @@ static int run_tar_extract(int target_fd) {
             (char *)JERBOA_TAR_PATH, "-xf", "bundle.tar", NULL
         };
         if (fchdir(target_fd) != 0) _exit(127);
+        /* The embedded bundle may have been archived from a group-writable
+         * checkout.  Its cache is private, so normalize extracted modes. */
+        umask(0077);
         execve(JERBOA_TAR_PATH, args, clean_env);
         _exit(127);
     }