fix(ci): umask 0022 in the git checkout step — act's 0000 made Ansible ignore ansible.cfg

Run 500 (this PR's first CI run) failed L0 prod-baremetal-not-dev-surface: act runs steps with
umask 0000, the checkout was world-writable, and Ansible (now present, via the toolbox) refuses
a world-writable directory as an ansible.cfg source. Reproduced and fixed locally in the pinned
image.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.gitea/workflows/gate.yml

@@ -130,6 +130,13 @@ jobs:
           REF: ${{ github.ref }}
         run: |
           set -euo pipefail
+          # act runs steps with umask 0000, so without this every checked-out directory is
+          # world-writable — and Ansible then IGNORES infra/ansible/ansible.cfg as a source
+          # ("Ansible is being run in a world writable directory"), which made the L0 check
+          # prod-baremetal-not-dev-surface fail on this PR's first CI run (run 500). The
+          # toolbox has Ansible, so that check now drives it for real. 0022 = what a
+          # workstation clone gets (reproduced locally: 0000 fails the check, 0022 passes).
+          umask 0022
           git config --global --add safe.directory "$PWD"
           git init -q .
           git remote add origin "${SERVER_URL}/${REPOSITORY}"

decisions/2026-11-08-gate-toolbox-container.md

@@ -24,6 +24,12 @@ is unchanged):
   every branch to `refs/remotes/origin/*`, tags, plus the event SHA; detached for a PR,
   `-B <branch>` for a push; asserts `HEAD == github.sha`. The job token goes to that one fetch via
   `GIT_CONFIG_*` env and is **not** persisted in `.git/config` (nothing later needs network git).
+  It sets **`umask 0022`** first: the PR's first CI run (run 500) failed L0
+  `prod-baremetal-not-dev-surface` because act runs steps with umask 0000, every checked-out
+  directory was world-writable, and Ansible (present in the toolbox, absent from the catthehacker
+  image) then ignored `infra/ansible/ansible.cfg`. Reproduced locally in the pinned image: clone
+  under umask 0000 → that check fails with the same message; under 0022 → `check OK`. Side
+  effect worth knowing: the Ansible-driven parts of that check now actually execute in CI.
 - **"Install pinned CI toolchain" step removed**, replaced by **"Toolchain is the one
   ci/versions.env pins"**: every `*_VERSION` in `ci/versions.env` must equal the image's
   `/etc/dev-toolchain-versions`, else `::error::DRIFT` and the job fails. Without this, dropping