fix(backup): privately stage restore archive

tools/tht/internal/safeio/private_unix.go

@@ -89,7 +89,11 @@ func ProtectPrivateRegular(path string) error {
 }
 
 func createCanonicalNewPrivateFile(path string, mode os.FileMode) (*os.File, error) {
-	file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, mode)
+	return createCanonicalNewPrivateFileWithFlags(path, mode, os.O_WRONLY)
+}
+
+func createCanonicalNewPrivateFileWithFlags(path string, mode os.FileMode, flags int) (*os.File, error) {
+	file, err := os.OpenFile(path, flags|os.O_CREATE|os.O_EXCL, mode)
 	if err != nil {
 		return nil, err
 	}
@@ -108,6 +112,13 @@ func createCanonicalNewPrivateParentFile(path string, mode os.FileMode) (*os.Fil
 	return createCanonicalNewPrivateFile(path, mode)
 }
 
+func createCanonicalNewPrivateParentReadWriteFile(path string, mode os.FileMode) (*os.File, error) {
+	if err := ValidatePrivateDirectory(filepath.Dir(path)); err != nil {
+		return nil, ErrUnsafeFile
+	}
+	return createCanonicalNewPrivateFileWithFlags(path, mode, os.O_RDWR)
+}
+
 // ValidatePrivateRegular requires a canonical, single-link private regular file.
 func ValidatePrivateRegular(path string) error {
 	if err := ValidateCanonicalPath(path); err != nil {