Ensure that files in git shed are read-only.

Still todo: ensure that file permissions are preserved when downloading
from a content store. Will require switching to using rsync, presumably.
I actually started out with that, but this somehow seemed more readable.