fix(package): apply setup ACL correction

tests/test_package.py

@@ -274,9 +274,10 @@ class PackageTests(unittest.TestCase):
                 self.assertTrue(Path(pkg.REPORT_ROOT).is_dir())
                 foreign = Path(pkg.INSTALL_ROOT, 'operator-note.txt')
                 foreign.write_text('keep me', encoding='utf-8')
-                pkg.uninstall()
+                with self.assertRaisesRegex(RuntimeError, 'not owned'):
+                    pkg.uninstall()
                 self.assertTrue(foreign.is_file())
-                self.assertFalse(Path(pkg.INSTALL_ROOT, 'HardeningKitty.psm1').exists())
+                self.assertTrue(Path(pkg.INSTALL_ROOT, 'HardeningKitty.psm1').is_file())
                 self.assertTrue(Path(pkg.INSTALL_ROOT).is_dir())
                 self.assertTrue(Path(pkg.REPORT_ROOT).is_dir())
             finally:
@@ -422,19 +423,33 @@ class PackageTests(unittest.TestCase):
                     else:
                         updater.control = old_control
 
-    def test_setup_source_directory_is_relative_to_package_root(self):
+    def test_setup_source_directory_is_absolute_from_package_root(self):
         original_cwd = os.getcwd()
         try:
             os.chdir(ROOT)
-            self.assertEqual(pkg._package_source(), '.')
+            self.assertEqual(Path(pkg._package_source()).resolve(), ROOT)
             with tempfile.TemporaryDirectory() as tmp:
                 os.chdir(tmp)
                 source_root = pkg._package_source()
-                self.assertFalse(os.path.isabs(source_root))
+                self.assertTrue(os.path.isabs(source_root))
                 self.assertTrue(os.path.isfile(os.path.join(source_root, 'WAPT', 'control')))
         finally:
             os.chdir(original_cwd)
 
+    def test_secure_directory_sets_inheritable_acl_without_recursive_rewrite(self):
+        commands = []
+        old_run = pkg.run
+        try:
+            pkg.run = lambda command, **kwargs: commands.append((command, kwargs))
+            with mock.patch.object(pkg.os, 'name', 'nt'):
+                pkg._secure_directory('/synthetic/package')
+        finally:
+            pkg.run = old_run
+        self.assertEqual(len(commands), 2)
+        self.assertIn('/grant:r', commands[0][0])
+        self.assertIn('/inheritance:r', commands[1][0])
+        self.assertTrue(all('/T' not in command for command, _ in commands))
+
     def test_offline_updater_requires_expected_archive_hash(self):
         with tempfile.TemporaryDirectory() as tmp:
             archive = Path(tmp, 'archive.zip')