fix: retain share-enforced Windows directory handles

Co-authored-by: Medulla <medulla@tinyhumans.ai>

Author: senamakel

crates/tinysecurity-audit/src/windows.rs

@@ -16,7 +16,9 @@ use windows_permissions::{
     wrappers,
 };
 
-const READ_CONTROL_ATTRIBUTES: u32 = 0x0002_0080;
+// Metadata-only opens do not participate in NTFS share-access accounting.
+// FILE_LIST_DIRECTORY makes the no-delete share mode an actual rename pin.
+const PIN_ACCESS: u32 = 0x0002_0081;
 const PIN_DIRECTORY: u32 = 0x0220_0000;
 const OPEN_REPARSE: u32 = 0x0020_0000;
 const REPARSE: u32 = 0x400;
@@ -164,7 +166,7 @@ fn verify_volume(root: &str) -> Result<()> {
 }
 fn pin(path: &Path) -> Result<File> {
     let file = OpenOptions::new()
-        .access_mode(READ_CONTROL_ATTRIBUTES)
+        .access_mode(PIN_ACCESS)
         .share_mode(3)
         .custom_flags(PIN_DIRECTORY)
         .open(path)

crates/tinysecurity-audit/src/windows_tests.rs

@@ -23,7 +23,7 @@ pub(crate) fn diagnose(path: &Path) {
             eprintln!("audit-stage=volume result={:?}", verify_volume(root));
         }
         let handle = match OpenOptions::new()
-            .access_mode(READ_CONTROL_ATTRIBUTES)
+            .access_mode(PIN_ACCESS)
             .share_mode(3)
             .custom_flags(PIN_DIRECTORY)
             .open(&current)
@@ -56,7 +56,7 @@ pub(crate) fn diagnose(path: &Path) {
         ("existing-journal", "audit.journal"),
     ] {
         match OpenOptions::new()
-            .access_mode(READ_CONTROL_ATTRIBUTES)
+            .access_mode(PIN_ACCESS)
             .share_mode(3)
             .custom_flags(OPEN_REPARSE)
             .open(path.join(name))