restore write protection on directories

* @dagss originally put code in that didn't protect directories
* @certik introduced a non-portable fix to add directory protection
* I removed the non-portable code when introducing `develop` functionality.
  (see 9d9f0b728bfc88d4b435b691bd95e3171159f1af )

Now I'm re-adding portable directory protection to protect us from
further foot-shooting.

We also need to temporarily allow writing to the artifact directory
after it's been built to store things like the id and build log.  I've
added a context manager to file utils based on a suggestion by @dagss to
simplify this.