Thank you very much for your answer, Ron.
Following your instructions, I created a folder “foo” under Public Folders and gave it the alias “bar”. I then added my portlet to it and changed the locale rule to say:
("foo" matches user.roleMembershipDNs) && (portalResource isDescendant ("bar"))
Unfortunately, when I access the portlet instance inside the folder (http://localhost:8585/meta/default/myportletapplication___myportlet/0000013230) it still has the wrong locale.
Changing the rule back to only checking the role makes it work just fine. I tried some more and stumbled upon something quite interesting: If I use a condition that checks for a specific string in the request URL with “matches”, the rule works when I use the URL before login (being first redirected to the login page), but not when I access the login page first and then go to my URL.
So it seems to me the rule is run only once after login (but before regarding the portal resource). The solution via the request URL is an acceptable workaround for me.
I can offer a sample deployment package if anyone is interested …