core.fileMode=false (repo-local or a machine-wide /etc/gitconfig) can silently drop the +x bit on every tracked script during checkout, which then surfaces later as a confusing "Permission denied" on whatever script happens to run next rather than as an obvious failure up front. ensure_exec_bits() re-applies +x from `git ls-files -s` (mode 100755) right after every pull, so a restore is self-healing regardless of cause. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>