special case permissions when creating `/opt`

or any other toplevel directory. Closes #4187