Fixup a couple differences with the official installer scripts

[Hoverbear]

Description

Found while working on #126 when testing against the official installer:

Checklist

• Formatted with cargo fmt
• Built with nix build
• Ran flake checks with nix flake check
• Added or updated relevant tests (leave unchecked if not applicable)
• Added or updated relevant documentation (leave unchecked if not applicable)
• Linked to related issues (leave unchecked if not applicable)

Validating with install.determinate.systems

If a maintainer has added the upload to s3 label to this PR, it will become available for installation via install.determinate.systems:

curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix/pr/$PR_NUMBER | sh -s -- install

[cole-h]

Ah, this is probably the true fix, rather than #278. I didn't realize upstream used 664 for some of these files...

We should probably audit the other file modes and make sure they match upstream, as well as leave a comment at each of those sites so that I don't make the same mistake 😅

[Hoverbear]

I'll be adding tests with curing that ensure we can install over the old scripts, which necessarily means the modes must be the same!