k8s: create workspace group-writable in fs-init (umask 002)

fs-init runs as uid 1001 and mkdir's the work/externals/github dirs at the
default 0755. The pod securityContext uses fsGroup: 1001, so every job
container process is in group 1001 — but 0755 grants the group only r-x, so a
job image running as a non-root uid other than 1001 can't write the workspace
and checkout fails with '.git: Permission denied'.

Set umask 002 in fs-init so those dirs are created 0775 (group-writable),
letting any job user write the workspace via the fsGroup.

Author: DJRH

packages/k8s/src/k8s/index.ts

@@ -106,6 +106,8 @@ export async function createJobPod(
   const workingDirPath = githubWorkspace?.split('/').slice(-2).join('/') ?? ''
 
   const initCommands = [
+    // group-writable dirs so non-1001 job images can write the workspace (fsGroup)
+    'umask 002',
     'mkdir -p /mnt/externals',
     'mkdir -p /mnt/work',
     'mkdir -p /mnt/github',