fix(windows): protect lifecycle and backup state

tools/tht/internal/backup/create.go

@@ -186,6 +186,12 @@ func createWithDependenciesTransaction(ctx context.Context, transaction *lifecyc
 	if err != nil {
 		return Result{}, err
 	}
+	if request.IncludeSecrets {
+		if err := safeio.ProtectPrivateRegular(reservation.path); err != nil {
+			_ = reservation.RemoveIfOwned()
+			return Result{}, errors.New("protect secret-bearing backup output")
+		}
+	}
 	published := false
 	defer func() {
 		if !published {