fix: harden operations and configuration recovery

internal/target/diagnostic_test.go

@@ -10,6 +10,20 @@ import (
 	"proxyctl/internal/target"
 )
 
+func TestReadOnlyWriteAuthorityRejectsUnreadableExistingFile(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("root can read files regardless of mode bits")
+	}
+	path := filepath.Join(t.TempDir(), "managed.json")
+	if err := os.WriteFile(path, []byte("{}\n"), 0o200); err != nil {
+		t.Fatal(err)
+	}
+	check := target.ReadOnlyWriteAuthority(path)
+	if check.OK || !strings.Contains(check.Evidence, "cannot be read") {
+		t.Fatalf("unreadable destination reported writable: %#v", check)
+	}
+}
+
 func TestReadOnlyWriteAuthorityRejectsSymlinkedFinalAndAncestorWithoutTouchingVictim(t *testing.T) {
 	for _, test := range []struct {
 		name string