fix(backup): privately stage restore archive

tools/tht/internal/safeio/files_test.go

@@ -3,6 +3,7 @@ package safeio
 import (
 	"errors"
 	"fmt"
+	"io"
 	"os"
 	"path/filepath"
 	"strings"
@@ -97,6 +98,57 @@ func TestWriteCanonicalNewFileRejectsExistingTargets(t *testing.T) {
 	}
 }
 
+func TestCreateCanonicalNewPrivateFileProvidesPrivateStreamingWriter(t *testing.T) {
+	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	directory, err := os.MkdirTemp(temporaryRoot, "tht-safeio-private-stream-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = os.RemoveAll(directory) })
+	if err := EnsurePrivateDirectory(directory); err != nil {
+		t.Fatal(err)
+	}
+
+	path := filepath.Join(directory, "archive.zip")
+	file, err := CreateCanonicalNewPrivateFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := file.Write([]byte("streamed archive")); err != nil {
+		_ = file.Close()
+		t.Fatal(err)
+	}
+	if _, err := file.Seek(0, io.SeekStart); err != nil {
+		_ = file.Close()
+		t.Fatal(err)
+	}
+	streamed := make([]byte, len("streamed archive"))
+	if _, err := io.ReadFull(file, streamed); err != nil {
+		_ = file.Close()
+		t.Fatal(err)
+	}
+	if string(streamed) != "streamed archive" {
+		_ = file.Close()
+		t.Fatalf("streamed contents through open file = %q, want %q", streamed, "streamed archive")
+	}
+	if err := file.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err := ValidatePrivateRegular(path); err != nil {
+		t.Fatalf("ValidatePrivateRegular() = %v, want owner-private streamed file", err)
+	}
+	contents, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(contents) != "streamed archive" {
+		t.Fatalf("streamed contents = %q, want %q", contents, "streamed archive")
+	}
+}
+
 func TestPreflightPrivateDirectoryAllowsOnlyAMissingFinalComponentWithoutMutation(t *testing.T) {
 	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
 	if err != nil {