deploy: normalize dir perms via rsync --chmod

Fix /photos/ returning 404 — the photos dir on the server ended up mode 700
(drwx------), so nginx (running as www) could not traverse it. All URLs
under /photos/ returned 404 despite content being present.

Add -p + --chmod=Du=rwx,Dgo=rx,Fu=rw,Fgo=r so future rsyncs normalize
permissions on every transferred entry, preventing recurrence.

.github/workflows/deploy.yml

@@ -173,7 +173,8 @@ jobs:
       - name: Deploy via rsync
         run: |
           cp .env _site/.env
-          rsync -rl --delete \
+          rsync -rlp --delete \
+            --chmod=Du=rwx,Dgo=rx,Fu=rw,Fgo=r \
             --exclude='content/.indiekit/' \
             --exclude='og/' \
             --exclude='fonts/' \
@@ -183,11 +184,13 @@ jobs:
 
       - name: Sync OG images and fonts
         run: |
-          rsync -rl --ignore-existing \
+          rsync -rlp --ignore-existing \
+            --chmod=Du=rwx,Dgo=rx,Fu=rw,Fgo=r \
             -e "ssh -p 222" \
             _site/og/ \
             ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }}:/usr/local/bastille/jails/web/root/usr/local/www/blog/og/
-          rsync -rl --ignore-existing \
+          rsync -rlp --ignore-existing \
+            --chmod=Du=rwx,Dgo=rx,Fu=rw,Fgo=r \
             -e "ssh -p 222" \
             _site/fonts/ \
             ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }}:/usr/local/bastille/jails/web/root/usr/local/www/blog/fonts/