This has two advantages:
1) If building as non-root, then we can't modify xattrs, such as
selinux ones, yet selinux will write then, making a bare repo
not match the checksums (it has unexpected xattrs that selinux made)
2) We check out as MODE_NONE, not MODE_USER, which in combination with
BARE_USER forces the files to be copied out of the cache, rather
than using hardlinks into the cache which could mutate the cache.
ef3582325d