tests: clear the sealed attribute before corrupting a cached payload

`warm_hits_reject_corrupted_cached_bytes_with_a_valid_header` rewrites a byte of
a cached payload to prove the warm path rejects it. The Unix arm relaxes the file
mode to 0600 first; Windows has no equivalent, so the payload stayed read-only as
the cache seals it and the write failed with `Access is denied` instead of
exercising the rejection path.

The Windows arm clears the read-only attribute before the rewrite. The assertion
is untouched: the test still requires the warm path to reject the corrupted bytes.

Validation: the test passes on x86_64-pc-windows-msvc.

Design-Signed-Off-By: Hermes Agent (deepseek-v4.1-flash); design-review=1c01

Author: R4yHarris

helios/src/package/export.rs

@@ -1626,6 +1626,14 @@ mod tests {
             use std::os::unix::fs::PermissionsExt;
             std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600)).unwrap();
         }
+        // Sealed payloads are read-only on Windows, so the attribute is cleared before the
+        // corrupted-bytes rewrite, matching what the Unix mode change does above.
+        #[cfg(windows)]
+        {
+            let mut permissions = std::fs::metadata(&path).unwrap().permissions();
+            permissions.set_readonly(false);
+            std::fs::set_permissions(&path, permissions).unwrap();
+        }
         use std::io::{Seek, SeekFrom, Write};
         let mut file = OpenOptions::new().write(true).open(&path).unwrap();
         file.seek(SeekFrom::Start(offset + 1)).unwrap();