hive-c0re, hivectl: make the htpasswd and wg key tests fail on the in-place write

The htpasswd test now seeds the temp path at 0600, so only the explicit
chmod on the temp yields 0644. The wg test blocks the temp path with a
directory and asserts the write fails with the existing key untouched,
which an in-place write cannot satisfy.

hivectl/src/wg.rs

@@ -300,16 +300,25 @@ mod tests {
         }
     }
 
-    /// The key lands at `0400` with its bytes intact, replacing whatever was
-    /// there, and no temp file is left beside it.
+    /// The key reaches its path only by a rename from a sibling temp: with
+    /// the temp path blocked, the write fails and the existing key is left
+    /// byte-for-byte as it was. Once unblocked, the key lands at `0400` with
+    /// its bytes intact and no temp file beside it.
     #[test]
-    fn key_is_written_0400_with_no_temp_left() {
+    fn key_is_written_through_a_temp_and_lands_0400() {
         use std::os::unix::fs::PermissionsExt as _;
 
         let dir = std::env::temp_dir().join(format!("hivectl-wg-key-{}", std::process::id()));
         std::fs::create_dir_all(&dir).expect("mkdir");
         let path = dir.join("hive.key");
-        std::fs::write(&path, "stale").expect("seed");
+        let tmp = dir.join("hive.key.tmp");
+        std::fs::write(&path, "old-key\n").expect("seed");
+        std::fs::create_dir(&tmp).expect("block tmp");
+
+        let blocked = write_key_0400(&path, b"key-bytes\n");
+        assert!(blocked.is_err(), "a blocked temp must fail the write");
+        assert_eq!(std::fs::read(&path).expect("read seed"), b"old-key\n");
+        std::fs::remove_dir(&tmp).expect("unblock tmp");
 
         write_key_0400(&path, b"key-bytes\n").expect("write");
         let mode = std::fs::metadata(&path).expect("stat").permissions().mode() & 0o777;