fix(windows): protect lifecycle and backup state

tools/tht/internal/backup/preflight_test.go

@@ -16,6 +16,7 @@ import (
 	"time"
 
 	"github.com/aritmolab/thothii/tools/tht/internal/config"
+	"github.com/aritmolab/thothii/tools/tht/internal/safeio"
 )
 
 func TestPreflightReturnsValidatedMetadataAndCallsAllTargetChecksWithoutExtracting(t *testing.T) {
@@ -573,10 +574,20 @@ func preflightTestInstallation(t *testing.T) config.Installation {
 	if err != nil {
 		t.Fatal(err)
 	}
-	return config.Installation{
+	installation := config.Installation{
 		Path:             filepath.Join(root, "deploy", "local-dev", "thothii-installation.yaml"),
 		ProjectDirectory: root,
 	}
+	controlParent := filepath.Dir(installation.ControlDirectory())
+	for _, directory := range []string{controlParent, installation.ControlDirectory()} {
+		if err := os.MkdirAll(directory, 0o700); err != nil {
+			t.Fatal(err)
+		}
+		if err := safeio.ProtectPrivateDirectory(directory); err != nil {
+			t.Fatalf("protect preflight fixture directory %q: %v", directory, err)
+		}
+	}
+	return installation
 }
 
 func permissivePreflightDependencies() PreflightDependencies {