security: tighten readable/regular file checks in CLI tools

docs/showcase/run.py

@@ -5,10 +5,15 @@ from pathlib import Path
 
 
 def _jsonl_path(arg):
-    """Resolve the CLI file argument; require an existing regular file."""
+    """Resolve the CLI file argument; require an existing readable regular file."""
     path = Path(arg).resolve()
     if not path.is_file():
         sys.exit(f"not a readable file: {arg}")
+    try:
+        with path.open("rb"):
+            pass
+    except OSError:
+        sys.exit(f"not a readable file: {arg}")
     return path
 
 def call(method, params):