fix: anchor profile directory traversal

internal/app/storage_test.go

@@ -168,6 +168,9 @@ func TestLoadSecuresExistingSecretBearingConfiguration(t *testing.T) {
 		t.Fatalf("load existing configuration: %v", err)
 	}
 	assertMode(t, path, 0o600)
+	if _, err := os.Lstat(path + ".lock"); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("view-only Load unexpectedly created a lock: %v", err)
+	}
 }
 
 func assertMode(t *testing.T, path string, want os.FileMode) {