pub fn workload_dir(root: &Path, ident: &str) -> PathBuf
The per-workload directory materialized secrets are written to.