fix: run DWH verification with read-only registry access

tools/dwh-auth/internal/service/service_test.go

@@ -212,6 +212,7 @@ func TestVerifyMapsMultipleLegacyRecordsToServiceUnavailable(t *testing.T) {
 
 func TestListenAndServeFailsClosedForInvalidPathsAndCollisions(t *testing.T) {
 	root := t.TempDir()
+	initializeRegistry(t, root)
 	parent := t.TempDir()
 	for _, tc := range []struct {
 		name, registryRoot, socket string
@@ -252,8 +253,47 @@ func TestListenAndServeFailsClosedForInvalidPathsAndCollisions(t *testing.T) {
 	}
 }
 
+func TestListenAndServeRejectsUnsafeSocketParents(t *testing.T) {
+	root := t.TempDir()
+	initializeRegistry(t, root)
+	for _, mode := range []os.FileMode{0o770, 0o702} {
+		t.Run("mode "+mode.String(), func(t *testing.T) {
+			parent := t.TempDir()
+			if err := os.Chmod(parent, mode); err != nil {
+				t.Fatalf("Chmod(%v) error = %v", mode, err)
+			}
+			socket := filepath.Join(parent, "verify.sock")
+			err := ListenAndServe(context.Background(), Config{RegistryRoot: root, Socket: socket, Logger: log.New(&bytes.Buffer{}, "", 0), Now: time.Now})
+			if err == nil {
+				t.Fatalf("ListenAndServe(parent mode %v) error = nil, want refusal", mode)
+			}
+			if _, err := os.Lstat(socket); !errors.Is(err, os.ErrNotExist) {
+				t.Fatalf("unsafe parent created socket: %v", err)
+			}
+		})
+	}
+}
+
+func TestListenAndServeRejectsForeignOwnedSocketParent(t *testing.T) {
+	root := t.TempDir()
+	initializeRegistry(t, root)
+	parent := t.TempDir()
+	socket := filepath.Join(parent, "verify.sock")
+	previous := socketParentOwner
+	t.Cleanup(func() { socketParentOwner = previous })
+	socketParentOwner = func(string) (uint32, error) { return uint32(os.Geteuid()) + 1, nil }
+	err := ListenAndServe(context.Background(), Config{RegistryRoot: root, Socket: socket, Logger: log.New(&bytes.Buffer{}, "", 0), Now: time.Now})
+	if err == nil {
+		t.Fatal("ListenAndServe() error = nil, want foreign-parent refusal")
+	}
+	if _, err := os.Lstat(socket); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("foreign parent created socket: %v", err)
+	}
+}
+
 func TestListenAndServeReclaimsOnlyOwnedStaleSocketAndCleansUpOnCancellation(t *testing.T) {
 	root := t.TempDir()
+	initializeRegistry(t, root)
 	socket := filepath.Join(t.TempDir(), "verify.sock")
 	stale, err := net.ListenUnix("unix", &net.UnixAddr{Name: socket, Net: "unix"})
 	if err != nil {
@@ -290,6 +330,7 @@ func TestListenAndServeReclaimsOnlyOwnedStaleSocketAndCleansUpOnCancellation(t *
 
 func TestListenAndServeRefusesStaleSocketWithForeignOwner(t *testing.T) {
 	root := t.TempDir()
+	initializeRegistry(t, root)
 	socket := filepath.Join(t.TempDir(), "verify.sock")
 	stale, err := net.ListenUnix("unix", &net.UnixAddr{Name: socket, Net: "unix"})
 	if err != nil {
@@ -313,6 +354,7 @@ func TestListenAndServeRefusesStaleSocketWithForeignOwner(t *testing.T) {
 
 func TestListenAndServeRefusesLiveSocket(t *testing.T) {
 	root := t.TempDir()
+	initializeRegistry(t, root)
 	socket := filepath.Join(t.TempDir(), "verify.sock")
 	live, err := net.ListenUnix("unix", &net.UnixAddr{Name: socket, Net: "unix"})
 	if err != nil {
@@ -330,6 +372,7 @@ func TestListenAndServeRefusesLiveSocket(t *testing.T) {
 
 func TestListenAndServeCleanupRefusesChangedSocketPath(t *testing.T) {
 	root := t.TempDir()
+	initializeRegistry(t, root)
 	socket := filepath.Join(t.TempDir(), "verify.sock")
 	ctx, cancel := context.WithCancel(context.Background())
 	errs := make(chan error, 1)
@@ -363,6 +406,17 @@ func TestListenAndServeCleanupRefusesChangedSocketPath(t *testing.T) {
 	}
 }
 
+func initializeRegistry(t *testing.T, root string) {
+	t.Helper()
+	store, err := registry.Open(root)
+	if err != nil {
+		t.Fatalf("Open() error = %v", err)
+	}
+	if err := store.Close(); err != nil {
+		t.Fatalf("Close() error = %v", err)
+	}
+}
+
 func waitForReadySocket(t *testing.T, socket string) {
 	t.Helper()
 	deadline := time.Now().Add(2 * time.Second)