CI should be using "normal" mistrust config
#475 (closed) occurred in part because our CI is running with wholly unrealistic permissions etc.
Ideally we would fix this, and remove the mistrust override. I guess we would need to (at least) set the umask and perhaps change to a different user (or have the CI do so for us).
(setting this to the 1.0 milestone, mostly so that if we defer this it's done as a deliberate decision.)