fix(backup): use platform private staging controls

tools/tht/internal/backup/preflight_unix_test.go

@@ -0,0 +1,48 @@
+//go:build !windows
+
+package backup
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/aritmolab/thothii/tools/tht/internal/config"
+)
+
+func TestStageArchiveRejectsSymlinkedInstallationAncestor(t *testing.T) {
+	root, err := filepath.EvalSymlinks(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	realProject := filepath.Join(root, "real-project")
+	linkedProject := filepath.Join(root, "linked-project")
+	if err := os.Mkdir(realProject, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(realProject, linkedProject); err != nil {
+		t.Fatal(err)
+	}
+	installation := config.Installation{
+		Path:             filepath.Join(linkedProject, "deploy", "local-dev", "thothii-installation.yaml"),
+		ProjectDirectory: linkedProject,
+	}
+	if err := os.MkdirAll(installation.ControlDirectory(), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	archive := filepath.Join(root, "valid.zip")
+	writePreflightArchive(t, archive, preflightArchiveSpec{
+		entries: []preflightArchiveEntry{{path: "configuration/operator.env", body: []byte("safe")}},
+	})
+	result, err := Preflight(context.Background(), installation, PreflightRequest{Archive: archive, Confirm: true}, permissivePreflightDependencies())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer result.CloseArchive()
+
+	if _, err := result.StageArchive(context.Background()); err == nil || !strings.Contains(err.Error(), "staging root") {
+		t.Fatalf("StageArchive() error = %v, want unsafe symlinked staging-root rejection", err)
+	}
+}