--experimental_split_coverage_postprocessing makes COVERAGE_DIR read-only before coverage post-processing runs

### Description of the bug:

When using --experimental_split_coverage_postprocessing, the coverage post-processing action fails with "Permission denied" errors because Bazel makes COVERAGE_DIR read-only after the test action completes but before the coverage collection script runs.

### Which category does this issue belong to?

Core

### What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

Reproduction steps:

1. Enable split coverage post-processing in .bazelrc:
`build:coverage --experimental_split_coverage_postprocessing`
`build:coverage --experimental_fetch_all_coverage_outputs`

2. Run coverage on a C++ test:
`bazel coverage --config=coverage //path/to:test`

### Which operating system are you running Bazel on?

Linux

### What is the output of `bazel info release`?

release 8.5.1

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

_No response_

### What's the output of `git remote get-url origin; git rev-parse HEAD` ?

```text
git@github.com:cloudflare/workerd.git
9c70d739834b204ddf954a65a59766e852f60d9f
```

### If this is a regression, please try to identify the Bazel commit where the bug was introduced with bazelisk --bisect.

_No response_

### Have you found anything relevant by searching the web?

_No response_

### Any other information, logs, or outputs that you want to share?

Fix that works for aspect_rules_js (which should be fixed in bazel instead): https://github.com/aspect-build/rules_js/pull/2653

The fix we had to write in order to solve this: https://github.com/cloudflare/workerd/pull/5881/changes/9c70d739834b204ddf954a65a59766e852f60d9f

Start with the .bazelrc settings and the bazel coverage command described in the reproduction, then trace the split coverage post-processing path and when COVERAGE_DIR permissions change. Compare the behavior with aspect_rules_js PR 2653 and the workerd fix. Done means coverage post-processing completes without Permission denied errors on Linux.

Written by the indexing model from the issue text.