fix: harden operations and configuration recovery

internal/dockerdaemon/dockerdaemon_test.go

@@ -546,6 +546,9 @@ func TestDockerDaemonPreservesAndRestoresExistingConfiguration(t *testing.T) {
 	if got := a.SetDesired(context.Background(), true, activeProfile()); got.Err != nil {
 		t.Fatal(got.Err)
 	}
+	if info, err := os.Stat(daemonPath); err != nil || info.Mode().Perm() != 0o600 {
+		t.Fatalf("managed mode = %v, %v; want owner-only", info, err)
+	}
 	if got := a.SetDesired(context.Background(), false, nil); got.Err != nil || got.Inspection.State != target.External {
 		t.Fatalf("disable = %#v", got)
 	}