ensure_prereceive_hook only during setup, needs sudo