swarm-archive vm test: the fake store is readable by the prune whatever the writer's umask

nix/vm-tests/swarm-archive.nix

@@ -31,7 +31,11 @@ let
   agentRoot = "/var/lib/hyperhive/agents";
 
   # A directory is a leaf, a file in it a field: `kv get -field=<f> <path>`.
+  # The store stays readable by every caller whatever the umask of the writer:
+  # the users unit runs with `UMask=0027` and its `kv put` creates the parent
+  # directories, which the prune (another user) must still traverse.
   fakeBao = pkgs.writeShellScriptBin "bao" ''
+    umask 022
     store=${store}
     case "$1 $2" in
       "login -method=cert") echo faketoken; exit 0 ;;