We recently found out that one of our build scripts in Fuchsia was writing data into a directory outside of the source checkout (outside of workdir on bots). This issue wasn't caught on the bots because directories outside of workdir are currently writable, but there's no reason for them to be. Kitchen should make these directories read-only to catch these issues.