Hi, I found the cause of the issue: I had set UMASK 022 in /etc/login.defs on the build machine.
After setting it back to the Debian default (027) and rebuilding from scratch, the resulting system is usable again. Should it be mentioned in the documentation? A hardened umask value is quite frequent on generic servers and build boxes. I argue that it should not break the builds in such unexpected ways (Debian 12 builds used to work even with the build box umask set to 022), but mentioning in the live manual that the building with an umask != 022 is not supported would be the next best thing. Cheers
