fix: restrict droplet shim permissions and annotate test range (SonarCloud) (#8870)

The generated droplet shim only needs to run as its creator, so 0700 keeps
other local accounts from reading the CLI path it invokes. The reversed
range in the arrow-key test is the case under test, not an accident.

🤖 Generated with Codebuff

Co-authored-by: Codebuff <noreply@codebuff.com>

crates/engine/src/automate_cmds.rs

@@ -358,7 +358,9 @@ fn write_shim(droplet: &str) -> Result<String> {
     #[cfg(unix)]
     {
         use std::os::unix::fs::PermissionsExt;
-        let _ = std::fs::set_permissions(&shim, std::fs::Permissions::from_mode(0o755));
+        // The shim only has to run as the user who created it; 0o755 would also let every other
+        // local account read and execute it.
+        let _ = std::fs::set_permissions(&shim, std::fs::Permissions::from_mode(0o700));
     }
     Ok(shim)
 }

crates/ui-egui/src/widgets.rs

@@ -2367,7 +2367,8 @@ mod tests {
 
     #[test]
     fn arrow_keys_on_a_field_with_a_reversed_range_do_not_panic() {
-        let mut h = focused(5.0, 10.0..=0.0);
+        // The empty range is the case under test — arrow keys must not panic on it.
+        let mut h = focused(5.0, 10.0..=0.0); // NOSONAR
         let _ = press(&mut h, Modifiers::NONE, Key::ArrowUp);
         let mut h = focused(5.0, f32::NAN..=10.0);
         let _ = press(&mut h, Modifiers::NONE, Key::ArrowDown);