fix(safeio): retain private file parent handles

tools/tht/internal/safeio/preflight_windows.go

@@ -2,22 +2,20 @@
 
 package safeio
 
-import (
-	"errors"
-	"path/filepath"
-
-	"golang.org/x/sys/windows"
-)
+import "golang.org/x/sys/windows"
 
 func preflightPrivateDirectory(path string) (bool, error) {
 	parents, target, err := openCanonicalWindowsParent(path)
-	if err != nil {
+	if err != nil || parents == nil || len(parents.handles) == 0 {
+		if parents != nil {
+			parents.Close()
+		}
 		return false, ErrUnsafeFile
 	}
 	defer parents.Close()
-	handle, err := openWindowsComponent(filepath.Join(parents.directory, target), true)
+	handle, err := openWindowsRelativeComponent(parents.handles[len(parents.handles)-1], target, true, windows.GENERIC_READ)
 	if err != nil {
-		if errors.Is(err, windows.ERROR_FILE_NOT_FOUND) {
+		if isWindowsRelativeNotFound(err) {
 			writableParent, accessErr := openWindowsComponentWithAccess(
 				parents.directory,
 				true,