TestSaveTightensPreexistingLoosePerms covers the upgrade path fresh-bootstrap misses: a config.yaml from an older world-readable codehamr (or a hand-edit) starts at 0o644, and os.WriteFile preserves an existing file's mode, so Save would rewrite the bytes (including a fresh hamrpass token) while lea
(t *testing.T)
nothing calls this directly
no test coverage detected