writ deploy/sops: route the decrypted-plaintext write through a root #433

Epic: #430 · Feature: #405

Phase 3.4 of windows-native-permissions.md. The site behind
TestExecute_SopsChains, and the one that writes decrypted plaintext -- the second most
security-relevant write in the campaign after the private key.

Exit: the write flows through an fsroot.Dir supplied by its caller; the mode is enforced on Windows,
proved by a DACL read-back in the shape phase 2 established.