fix: run DWH verification with read-only registry access

tools/dwh-auth/internal/registry/store_test.go

@@ -112,6 +112,82 @@ func TestOpenRejectsSymlinkedRegistryRootAndDirectories(t *testing.T) {
 	})
 }
 
+func TestOpenReadOnlyRequiresCompletePreprovisionedRegistryAndNeverCreates(t *testing.T) {
+	root := t.TempDir()
+	before, err := os.ReadDir(root)
+	if err != nil {
+		t.Fatalf("ReadDir(before) error = %v", err)
+	}
+	if _, err := OpenReadOnly(root); err == nil {
+		t.Fatal("OpenReadOnly(incomplete) error = nil, want refusal")
+	}
+	after, err := os.ReadDir(root)
+	if err != nil {
+		t.Fatalf("ReadDir(after) error = %v", err)
+	}
+	if !reflect.DeepEqual(before, after) {
+		t.Fatalf("OpenReadOnly(incomplete) changed root entries: before=%v after=%v", before, after)
+	}
+
+	admin := openStore(t, root)
+	item := syntheticRecord(13)
+	if err := admin.Add(item); err != nil {
+		t.Fatalf("Add() error = %v", err)
+	}
+	if err := admin.Close(); err != nil {
+		t.Fatalf("Close(admin) error = %v", err)
+	}
+	for _, path := range []string{root, filepath.Join(root, "active"), filepath.Join(root, "revoked")} {
+		if err := os.Chmod(path, 0o750|os.ModeSetgid); err != nil {
+			t.Fatalf("Chmod(%q, 2750) error = %v", path, err)
+		}
+	}
+	if info, err := os.Stat(filepath.Join(root, registryLockName)); err != nil || info.Mode().Perm() != 0o640 {
+		t.Fatalf("registry lock = (%v, %v), want 0640", info, err)
+	}
+	entriesBefore := registryEntryModes(t, root)
+	reader, err := OpenReadOnly(root)
+	if err != nil {
+		t.Fatalf("OpenReadOnly() error = %v", err)
+	}
+	defer reader.Close()
+	if found, err := reader.Find(item.KeyID); err != nil || found.KeyID != item.KeyID {
+		t.Fatalf("Find() = (%#v, %v), want protected record", found, err)
+	}
+	if err := reader.Check(); err != nil {
+		t.Fatalf("Check() error = %v", err)
+	}
+	if err := reader.Add(syntheticRecord(14)); err == nil {
+		t.Fatal("read-only Add() error = nil, want refusal")
+	}
+	if err := reader.Revoke(item.KeyID, "synthetic", item.CreatedAt.Add(time.Hour)); err == nil {
+		t.Fatal("read-only Revoke() error = nil, want refusal")
+	}
+	if got := registryEntryModes(t, root); !reflect.DeepEqual(got, entriesBefore) {
+		t.Fatalf("read-only operations changed registry entries: before=%v after=%v", entriesBefore, got)
+	}
+}
+
+func registryEntryModes(t *testing.T, root string) []string {
+	t.Helper()
+	var result []string
+	for _, directory := range []string{root, filepath.Join(root, "active"), filepath.Join(root, "revoked")} {
+		entries, err := os.ReadDir(directory)
+		if err != nil {
+			t.Fatalf("ReadDir(%q) error = %v", directory, err)
+		}
+		for _, entry := range entries {
+			info, err := entry.Info()
+			if err != nil {
+				t.Fatalf("Info(%q) error = %v", entry.Name(), err)
+			}
+			result = append(result, filepath.Join(directory, entry.Name())+":"+info.Mode().String())
+		}
+	}
+	sort.Strings(result)
+	return result
+}
+
 func TestCheckRejectsUnsafeModesAndSymlinkedRecords(t *testing.T) {
 	t.Run("unsafe active mode", func(t *testing.T) {
 		root := t.TempDir()