deploy: Consistently use fd-relative API

While looking to fix a different bug here, I found the current
state of things where we had a mix of fd-relative API versus not
frustrating.

Change the code around to consistently use *at, and also add some more
tests.