Optionally provide more safety when replacing target_roots

Allow callers to replace_roots to ensure they are not violating
other callers assumptions, specifically by asserting that targets
have not previously been read by another task.

Opt-in for now, but easily switched to opt-out later if it seems
like a good idea.