Oh, brilliant.

Note to self: permission needs to be 755. Not 644. (Or possibly 555, which I cannot check, but *not* 644.)

I wouldn't feel so dumb if I hadn't checked myself on that twice already.