fix(auth): atomically secure Windows lock creation

tools/tht/internal/safeio/replace_windows.go

@@ -58,24 +58,17 @@ func writePrivateTemporary(directory string, contents []byte) (string, error) {
 			return "", err
 		}
 		path := filepath.Join(directory, name)
-		file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600)
+		file, err := createCanonicalNewPrivateFile(path, 0o600)
 		if errors.Is(err, os.ErrExist) {
 			continue
 		}
 		if err != nil {
 			return "", err
 		}
-		if err := ProtectPrivateRegular(path); err != nil {
-			_ = file.Close()
-			_ = os.Remove(path)
-			return "", err
-		}
-		if err := file.Chmod(0o600); err == nil {
-			var written int
-			written, err = file.Write(contents)
-			if err == nil && written != len(contents) {
-				err = io.ErrShortWrite
-			}
+		var written int
+		written, err = file.Write(contents)
+		if err == nil && written != len(contents) {
+			err = io.ErrShortWrite
 		}
 		if err == nil {
 			err = file.Sync()