Gitlab somehow posted that before I was done typing, so let me expand:
I don't like temporarily changing the file permissions. It feels too much like a hack: if we really need to change the file mode, why didn't we just have the more permissive mode in the first place? I know the answer is "so that we can deny FILE_WRITE_DATA given READONLY", but it ends up feeling very complex and fragile. The way we translate permissions has already come up with enough snags already...
I like the idea of always relying on metadata (including Erich's hidden-directory proposal) better.