Refuse inexact production selector authorities

crates/lazaret-prepared-lower/tests/prepared_lower.rs

@@ -67,6 +67,22 @@ impl Fixture {
     }
 }
 
+#[test]
+fn preexisting_fixed_children_require_exact_private_mode() {
+    for name in ["artifacts", "stages", "quarantine"] {
+        let fixture = Fixture::new();
+        std::fs::set_permissions(
+            fixture.root.join(name),
+            std::fs::Permissions::from_mode(0o777),
+        )
+        .unwrap();
+        assert!(
+            PreparedLowerStore::initialize(&fixture.root, fixture.catalog.clone()).is_err(),
+            "accepted wrong mode for {name}"
+        );
+    }
+}
+
 #[derive(Clone)]
 struct Entry<'a> {
     path: &'a str,