fix(restore): share retained staging capability

tools/tht/internal/backup/preflight_windows_test.go

@@ -45,6 +45,50 @@ func TestStageArchiveProtectsWindowsStagingArtifactsWithOwnerOnlyACLs(t *testing
 	}
 }
 
+func TestStageArchiveRetainsTwoFilesThroughOneWindowsRootCapability(t *testing.T) {
+	installation := preflightTestInstallation(t)
+	archives := []string{filepath.Join(t.TempDir(), "candidate.zip"), filepath.Join(t.TempDir(), "recovery.zip")}
+	for _, archive := range archives {
+		writePreflightArchive(t, archive, preflightArchiveSpec{
+			entries: []preflightArchiveEntry{{path: "configuration/operator.env", body: []byte("safe")}},
+		})
+	}
+	candidate, err := Preflight(context.Background(), installation, PreflightRequest{Archive: archives[0], Confirm: true}, permissivePreflightDependencies())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer candidate.CloseArchive()
+	recovery, err := Preflight(context.Background(), installation, PreflightRequest{Archive: archives[1], Confirm: true}, permissivePreflightDependencies())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer recovery.CloseArchive()
+
+	candidateStage, err := candidate.StageArchive(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	recoveryStage, err := recovery.stageArchiveAlongside(context.Background(), candidateStage)
+	if err != nil {
+		_ = candidateStage.Close()
+		t.Fatal(err)
+	}
+	if candidateStage.parent != recoveryStage.parent {
+		t.Fatal("paired stages did not share the retained root capability")
+	}
+	if err := candidateStage.Close(); err != nil {
+		_ = recoveryStage.Close()
+		t.Fatal(err)
+	}
+	if _, found, err := recoveryStage.parent.ReadRegular(recoveryStage.name, 1<<20); err != nil || !found {
+		_ = recoveryStage.Close()
+		t.Fatalf("recovery stage after candidate cleanup = found:%t err:%v", found, err)
+	}
+	if err := recoveryStage.Close(); err != nil {
+		t.Fatal(err)
+	}
+}
+
 func TestStageArchiveCloseUsesPinnedRootAfterAncestorSwap(t *testing.T) {
 	installation := preflightTestInstallation(t)
 	if err := os.MkdirAll(installation.ControlDirectory(), 0o700); err != nil {