fix(backup): privately stage restore archive

tools/tht/internal/backup/preflight_windows_test.go

@@ -11,7 +11,7 @@ import (
 	"github.com/aritmolab/thothii/tools/tht/internal/safeio"
 )
 
-func TestStageArchiveProtectsWindowsStagingDirectoriesWithOwnerOnlyACLs(t *testing.T) {
+func TestStageArchiveProtectsWindowsStagingArtifactsWithOwnerOnlyACLs(t *testing.T) {
 	installation := preflightTestInstallation(t)
 	if err := os.MkdirAll(installation.ControlDirectory(), 0o700); err != nil {
 		t.Fatal(err)
@@ -37,4 +37,7 @@ func TestStageArchiveProtectsWindowsStagingDirectoriesWithOwnerOnlyACLs(t *testi
 	if err := safeio.ValidatePrivateDirectory(staged.directory); err != nil {
 		t.Fatalf("staged archive directory ACL = %v, want owner-only", err)
 	}
+	if err := safeio.ValidatePrivateRegular(staged.path); err != nil {
+		t.Fatalf("staged archive ACL = %v, want owner-only", err)
+	}
 }