fix(stats-site): chmod 755/644 in TMP before rsync (nginx 403 fix)

stats-site/build.sh

@@ -29,7 +29,12 @@ sed \
   -e "s|{{ \.Site\.Params\.description }}|${SITE_DESC}|g" \
   "$SRC/layouts/index.html" > "$TMP/index.html"
 
-# 3. Atomic rsync, preserving runtime data (snapshot.json) and ownership.
+# 3. Set perms in TMP that nginx (www-data) can read. mktemp creates 700;
+#    --archive in rsync preserves them, leading to 403s in nginx logs.
+find "$TMP" -type d -exec chmod 0755 {} +
+find "$TMP" -type f -exec chmod 0644 {} +
+
+# 4. Atomic rsync, preserving runtime data (snapshot.json) and ownership.
 #    --delete removes files in DEST that aren't in TMP (cleans old assets),
 #    --exclude protects data/ (snapshot generator owns that).
 rsync -a --delete \