Per-area drop-ins for whp-jobs@.service: <NN>-<area>.conf, first line
"# whp-managed drop-in: whp-jobs@.service.d/<NN>-<area>.conf"
(scripts/lib/whp-dropins.sh). A lane whose job needs a path (for example a
configs/whp-state.d/<area>.list directory) adds ReadWritePaths= in its own
file here.

Installation (sandbox-audit DOC-1, re-checked 2026-11-07): the INSTANCE
directory whp-jobs@backup-upload.service.d/ is installed by
scripts/whp-stack-converge.d/50-backups.sh (whp_install_dropins). This
TEMPLATE-level directory is still installed by nothing (ensure-whp-jobs.sh
does not call whp_install_dropins), so a file added here has no effect on a
host until an installer learns it; put per-instance needs in the instance
directory, and flag a template-level one in your report.
