pkgctl repo clone: reimplement -u/--unprivileged