This prevents clients from seeing half-written files because
on POSIX systems renaming a file is an atomic operation.

Drive-by: Add test for repo file permission.