*/{apenwarr-redo,ssh-cert-authority}: use chmod-clean option instead of custom code