When you run `phd` with a nonstandard umask, it carries through to repository checkouts.
For now, we should probably just force umask to `022` in the `PullLocal` daemon.
If we eventually decide to `sudo` all CLI stuff as the daemon user we could use `077`, but we have a general assumption that access to the machine is sufficient to at least partially access possibly-sensitive information (e.g., by reading remote URLs out of the process list, accessing APC, or whatever else) and that letting attackers have shells on your production hosts is inadvisable; the not-completely-restrictive `022` umask is consistent with that.