fix: harden thothctl Windows safe I/O

tools/thothctl/internal/testsupport/symlink_windows_test.go

@@ -0,0 +1,38 @@
+//go:build windows
+
+package testsupport
+
+import (
+	"os"
+	"testing"
+
+	"golang.org/x/sys/windows"
+)
+
+func TestSymlinkPrivilegeUnavailableRecognizesOnlyWindowsPrivilegeErrors(t *testing.T) {
+	for name, err := range map[string]error{
+		"permission": os.ErrPermission,
+		"privilege not held": &os.LinkError{
+			Op:  "symlink",
+			Old: "target",
+			New: "link",
+			Err: windows.ERROR_PRIVILEGE_NOT_HELD,
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			if !isSymlinkPrivilegeUnavailable(err) {
+				t.Fatalf("isSymlinkPrivilegeUnavailable(%v) = false, want true", err)
+			}
+		})
+	}
+
+	unrelated := &os.LinkError{
+		Op:  "symlink",
+		Old: "target",
+		New: "link",
+		Err: windows.ERROR_FILENAME_EXCED_RANGE,
+	}
+	if isSymlinkPrivilegeUnavailable(unrelated) {
+		t.Fatal("unrelated Windows symlink failure was classified as a missing privilege")
+	}
+}