the second argument to mkdir is *not* the file permbits afterwards

instead, it’s the default value to use, before umask processing