fix: run DWH verification with read-only registry access

tools/dwh-auth/internal/securefile/securefile_linux_test.go

@@ -93,6 +93,33 @@ func TestProtectedPathsRejectSymlinks(t *testing.T) {
 }
 
 func TestProtectedPathsRejectUnsafeModes(t *testing.T) {
+	t.Run("setgid protected directories", func(t *testing.T) {
+		root := t.TempDir()
+		if err := os.Chmod(root, 0o750|os.ModeSetgid); err != nil {
+			t.Fatalf("Chmod(root) error = %v", err)
+		}
+		dir, err := OpenDir(root)
+		if err != nil {
+			t.Fatalf("OpenDir(2750 root) error = %v", err)
+		}
+		t.Cleanup(func() { _ = dir.Close() })
+		for _, mode := range []os.FileMode{
+			0o750 | os.ModeSetuid,
+			0o750 | os.ModeSetgid | os.ModeSetuid,
+			0o750 | os.ModeSticky,
+			0o770 | os.ModeSetgid,
+			0o752 | os.ModeSetgid,
+		} {
+			path := t.TempDir()
+			if err := os.Chmod(path, mode); err != nil {
+				t.Fatalf("Chmod(%v) error = %v", mode, err)
+			}
+			if _, err := OpenDir(path); err == nil {
+				t.Fatalf("OpenDir(%v) error = nil, want unsafe-mode refusal", mode)
+			}
+		}
+	})
+
 	t.Run("root", func(t *testing.T) {
 		root := t.TempDir()
 		if err := os.Chmod(root, 0o770); err != nil {
@@ -238,6 +265,22 @@ func TestLockSharedAllowsReadersAndBlocksExclusiveWriter(t *testing.T) {
 		t.Fatal("Dir lacks shared advisory locking")
 	}
 
+	if _, err := firstLocker.LockShared("registry.lock"); err == nil {
+		t.Fatal("LockShared(missing) error = nil, want preprovisioned-lock refusal")
+	}
+	if _, err := os.Lstat(filepath.Join(root, "registry.lock")); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("LockShared(missing) created lock: %v", err)
+	}
+	bootstrap, err := third.Lock("registry.lock")
+	if err != nil {
+		t.Fatalf("Lock(bootstrap) error = %v", err)
+	}
+	if err := bootstrap.Close(); err != nil {
+		t.Fatalf("Close(bootstrap) error = %v", err)
+	}
+	if info, err := os.Stat(filepath.Join(root, "registry.lock")); err != nil || info.Mode().Perm() != 0o640 {
+		t.Fatalf("bootstrapped lock mode = (%v, %v), want 0640", info, err)
+	}
 	firstShared, err := firstLocker.LockShared("registry.lock")
 	if err != nil {
 		t.Fatalf("LockShared(first) error = %v", err)