test(secureperm): force seed mode independent of umask

Address review feedback from coderabbitai on
pkg/secureperm/secureperm_unix_test.go:
TestLockDown_Mode0600_Unix and TestWriteFile_OverwriteDowngrades_Unix
seed a 0o644 file via os.WriteFile, but that mode is filtered by the
process umask. On a developer machine with a restrictive umask such
as 0o077, the seed lands at 0o600 and the tests pass without
exercising the downgrade path. Chmod the seed to 0o644 explicitly
after the write so the lax-mode precondition is deterministic.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

Author: lexfrei

pkg/secureperm/secureperm_unix_test.go

@@ -48,6 +48,13 @@ func TestLockDown_Mode0600_Unix(t *testing.T) {
 	if err := os.WriteFile(path, []byte("data"), 0o644); err != nil {
 		t.Fatalf("seed: %v", err)
 	}
+	// os.WriteFile is subject to the process umask; force 0o644 so the
+	// lax-mode precondition is deterministic regardless of the host
+	// umask (a restrictive 0o077 would otherwise make the seed 0o600
+	// and the test pass without proving LockDown tightened anything).
+	if err := os.Chmod(path, 0o644); err != nil {
+		t.Fatalf("chmod seed: %v", err)
+	}
 	if err := secureperm.LockDown(path); err != nil {
 		t.Fatalf("LockDown: %v", err)
 	}
@@ -72,6 +79,12 @@ func TestWriteFile_OverwriteDowngrades_Unix(t *testing.T) {
 	if err := os.WriteFile(path, []byte("old"), 0o644); err != nil {
 		t.Fatalf("seed: %v", err)
 	}
+	// Force the seed mode so the lax precondition survives a
+	// restrictive umask; otherwise the test can pass without actually
+	// verifying that WriteFile downgraded 0o644 to 0o600.
+	if err := os.Chmod(path, 0o644); err != nil {
+		t.Fatalf("chmod seed: %v", err)
+	}
 	if err := secureperm.WriteFile(path, []byte("new")); err != nil {
 		t.Fatalf("WriteFile: %v", err)
 	}