We try hard to avoid writing to the source tree during a build, but we have no way to detect when we fail. We should mark the whole tree as read-only at the start of the build in the CI system. This will also help diagnose issues where some other process than the build itself alters the source tree out from under the build.