Force cf-agent to be the only one to write cf_promises_validated.

This is so that the separation is clear: cf-agent writes the file, the
daemons read the file.