fix(ci): umask 0022 in the git checkout step — act's 0000 made Ansible ignore ansible.cfg

Run 500 (this PR's first CI run) failed L0 prod-baremetal-not-dev-surface: act runs steps with
umask 0000, the checkout was world-writable, and Ansible (now present, via the toolbox) refuses
a world-writable directory as an ansible.cfg source. Reproduced and fixed locally in the pinned
image.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

decisions/2026-11-08-gate-toolbox-container.md

@@ -24,6 +24,12 @@ is unchanged):
   every branch to `refs/remotes/origin/*`, tags, plus the event SHA; detached for a PR,
   `-B <branch>` for a push; asserts `HEAD == github.sha`. The job token goes to that one fetch via
   `GIT_CONFIG_*` env and is **not** persisted in `.git/config` (nothing later needs network git).
+  It sets **`umask 0022`** first: the PR's first CI run (run 500) failed L0
+  `prod-baremetal-not-dev-surface` because act runs steps with umask 0000, every checked-out
+  directory was world-writable, and Ansible (present in the toolbox, absent from the catthehacker
+  image) then ignored `infra/ansible/ansible.cfg`. Reproduced locally in the pinned image: clone
+  under umask 0000 → that check fails with the same message; under 0022 → `check OK`. Side
+  effect worth knowing: the Ansible-driven parts of that check now actually execute in CI.
 - **"Install pinned CI toolchain" step removed**, replaced by **"Toolchain is the one
   ci/versions.env pins"**: every `*_VERSION` in `ci/versions.env` must equal the image's
   `/etc/dev-toolchain-versions`, else `::error::DRIFT` and the job fails. Without this, dropping