fix(windows): protect lifecycle and backup state

tools/tht/internal/backup/restore_test.go

@@ -16,17 +16,21 @@ import (
 	"github.com/aritmolab/thothii/tools/tht/internal/compose"
 	"github.com/aritmolab/thothii/tools/tht/internal/config"
 	"github.com/aritmolab/thothii/tools/tht/internal/lifecycle"
+	"github.com/aritmolab/thothii/tools/tht/internal/safeio"
 )
 
 func TestRestorePublicPathUsesConcreteProductionPreflight(t *testing.T) {
-	root := t.TempDir()
+	root, err := filepath.EvalSymlinks(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
 	installation := config.Installation{
 		Path:             filepath.Join(root, "deploy", "local-dev", "thothii-installation.yaml"),
 		ProjectDirectory: root,
 	}
 	missing := filepath.Join(root, "missing.zip")
 
-	_, err := Restore(context.Background(), installation, RestoreRequest{Archive: missing, Confirm: true})
+	_, err = Restore(context.Background(), installation, RestoreRequest{Archive: missing, Confirm: true})
 
 	if err == nil || strings.Contains(err.Error(), "dependencies are unavailable") || !strings.Contains(err.Error(), "backup archive") {
 		t.Fatalf("Restore() error = %v, want production archive preflight", err)
@@ -924,6 +928,9 @@ func TestRecoveryCheckpointCleanupRemovesOnlyPrivateRegularFile(t *testing.T) {
 	if err := os.WriteFile(checkpoint, []byte("secret checkpoint"), 0o600); err != nil {
 		t.Fatal(err)
 	}
+	if err := safeio.ProtectPrivateRegular(checkpoint); err != nil {
+		t.Fatal(err)
+	}
 	if err := cleanupRecoveryCheckpoint(checkpoint); err != nil {
 		t.Fatal(err)
 	}