Annoyingly, Windows clients copying files to a SAMBA server cause the files to gain the execute bit

In your server's smb.conf file, add the following under the [global] section:

map archive = no
map system = no
map hidden = no

Now restart SAMBA on your server.

Presto.  No more execute bits on files that shouldn't get them.

Why does this work?

By default, SAMBA uses these execute bits on your Linux server's files as archive / system / hidden bits of the Windows file system.

Needless to say, you don't want this on file server systems that aren't exclusively accessed by Windows clients (e.g. your file server has MacOS or Linux clients too, for which the meaning of the execute bits is rather different than what SAMBA uses them for).