fix: harden workspace preprocessing contract

tools/thothctl/internal/safeio/files_windows_test.go

@@ -66,3 +66,9 @@ func TestOpenWindowsComponentBlocksMutationWhileHandleIsRetained(t *testing.T) {
 		}
 	})
 }
+
+func TestWriteCanonicalExclusiveRequiresRestrictiveMode(t *testing.T) {
+	if err := writeCanonicalExclusive(`C:\\tmp\\thothctl-output.yaml`, []byte("x"), 0o640); err == nil {
+		t.Fatal("accepted non-restrictive output mode")
+	}
+}