gosec: 0600 test fixture, annotated preview read of the vetted save path

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MCypLQF5AD8JD831Ea9S9q

Author: edimarlnx

cmd/tui-firewall/manage_ui_test.go

@@ -56,7 +56,7 @@ func TestSaveReportsAnUnchangedFile(t *testing.T) {
 		t.Fatalf("SnapshotOwnTable: %v", err)
 	}
 	content := strings.TrimSpace(listing) + "\n"
-	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
 		t.Fatalf("seeding the save file: %v", err)
 	}
 

cmd/tui-firewall/save.go

@@ -69,7 +69,7 @@ func (a *app) beginSave() tea.Cmd {
 // shows. A file that is missing or unreadable diffs as empty, which renders
 // every captured line as an addition — exactly what installing it would do.
 func currentSaveFile(path string) string {
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) // #nosec G304 -- path is the vetted save location (constant or the TUI_FIREWALL_SAVE_PATH override), read only to render the preview diff
 	if err != nil {
 		return ""
 	}