feat(worker): enforce durable trust state

internal/distworker/state_test.go

@@ -0,0 +1,33 @@
+package distworker
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestWorkerStateRoundTripUsesPrivatePermissions(t *testing.T) {
+	dir := filepath.Join(t.TempDir(), "state")
+	require.NoError(t, os.Mkdir(dir, 0o700))
+	path := filepath.Join(dir, "state.json")
+	want := workerState{Token: "secret", WorkerID: "worker-1", VerificationKey: "key", SigningKeyID: "key-2026", AccountID: 7, ConfigVersion: 2}
+	require.NoError(t, saveWorkerState(path, want))
+	info, err := os.Stat(path)
+	require.NoError(t, err)
+	assert.Equal(t, os.FileMode(0o600), info.Mode().Perm())
+	got, err := loadWorkerState(path)
+	require.NoError(t, err)
+	assert.Equal(t, want, got)
+}
+
+func TestWorkerStateRejectsInsecurePermissions(t *testing.T) {
+	dir := filepath.Join(t.TempDir(), "state")
+	require.NoError(t, os.Mkdir(dir, 0o700))
+	path := filepath.Join(dir, "state.json")
+	require.NoError(t, os.WriteFile(path, []byte(`{"token":"secret"}`), 0o644))
+	_, err := loadWorkerState(path)
+	require.Error(t, err)
+}