Major Description
The zk migrator tool recursively sets ACLs starting with the root, which we initially assumed was either the root of a dedicated ensemble or a chroot. However, there are at least two reasons for not doing it this way. First, shared ensembles might not really follow the practice of separating applications into branches, essentially creating a chroot for each. Second, there are paths we don't want to secure, like the ConsumersPath.
To fix this, we simply need to set the root ACL separately and start the recursion on each of the persistent paths to secure.