I finally figured it out. The culprit is line 470 of /etc/init.d/tc-config, which looks like this:
yes n | cp -ai /opt/. "$MOUNTPOINT"/opt/ 2>/dev/null
The purpose of the line is to copy the files below from core.gz's /opt to user's custom /opt, but only if the files don't already exist in the latter:
.filetool.lst
bootlocal.sh
shutdown.sh
.xfiletool.lst
bootsync.sh
tcemirror
However, a side effect of the command is that it changes ownership of user's custom /opt directory. Since /opt is my only persistent directory (I don't use or want a persistent home directory), this side effect a) bothers me tremendously and b) forces me to use sudo when restoring my TCL system (which consists of just the opt, boot, and tce directories) from a network backup.
Replacing the offending line (line 470 in /etc/init.d/tc-config) with these two lines does what the command was intended to do, without the undesirable side effect:
yes n | cp -ai /opt/* "$MOUNTPOINT"/opt/ 2>/dev/null
yes n | cp -ai /opt/.[!.]* "$MOUNTPOINT"/opt/ 2>/dev/null
If possible, please include this fix in future releases.