Writable project root paths (keys) for overlay subdirectories.
Caller fills from Folder.build_roots() or daemon policy.