To prevent this issue from occurring on agent machines that haven't been upgraded yet, temporarily set the root users umask to 022 before the upgrade. Then have it changed back to its expected value after the upgrade. Of course, this only applies if the agent is installed as root. The upgrade will run as whatever user the agent is installed as.
There are a few ways to solve this after it is already a problem:
It is not uncommon to install the CA Release Automation Agent as a non-root user. If you need to install the agent as a non-root user then details on how to do this are available here:
Install Unix / Linux Agent to Run as Non-Root User
Installing the agent as a non-root user after the agent has been installed and had deployments run against it might cause unexpected problems. This is because the deployment workflows might do things that need certain privileges. The deployment workflows are custom workflows based on your organizations (application teams) needs. Suddenly changing the user used to perform all those tasks may incur some downtime while figuring out how to get it accomplished with a non-root user.