Fix inverted umask

Apparently octal umasks specify "negative permission logic",
aka a NOR mask, completely *opposite* the way chmod works.
(Why this didn't come up in my earlier tests, I can't begin
to fathom.)