Ensure that files in git shed are read-only.

Still todo: ensure that file permissions are preserved when downloading
from a content store. Will require switching to using rsync, presumably.
Any advantage to using the constants in `stat`, eg `S_IWRITE`, `S_IWGRP`, `S_IWOTH`?