rotate.sh: harden rotations
Without this change, a compromised low-privileged pusher-user can alter older copies.