Distinct folders that need write access (bwrap overlay roots).
Folder.roots on the daemon — same result as shipping build_roots(), without local project_files.
Write-root folder rows (paths are realpaths)