Make release validation portable

docs/releases/v0.10.1.md

@@ -0,0 +1,33 @@
+# Weatherreporter v0.10.1
+
+This release repairs release validation after the `v0.10.0` pipeline failed in
+its privileged build container. Application behavior is unchanged from
+`v0.10.0`.
+
+## Summary
+
+The unreadable-secret configuration test now verifies that its process is
+actually subject to file permission bits before asserting that a mode-`000`
+file cannot be read. This keeps the test meaningful for ordinary users while
+allowing the release suite to run correctly in privileged containers.
+
+## Compatibility
+
+This patch release makes no changes to Weatherreporter's CLI, configuration,
+report output, integrations, prompts, profiles, or operating behavior. It is
+fully compatible with `v0.10.0`.
+
+## Upgrade
+
+No special operator action is required. Use `v0.10.1` in place of `v0.10.0`;
+the `v0.10.0` tag remains immutable, but its failed pipeline did not publish
+release binaries.
+
+## Changes
+
+- Made the unreadable-secret test capability-aware when the test process can
+  bypass filesystem permission bits.
+- Preserved the production contract that genuinely unreadable secret files
+  fail configuration loading.
+- Restored portable release validation in Woodpecker's privileged Go
+  container.

internal/config/config_test.go

@@ -1674,6 +1674,9 @@ func TestLoadSecretsRejectsInvalidDirectoryEntries(t *testing.T) {
 				t.Cleanup(func() {
 					_ = os.Chmod(path, 0o600)
 				})
+				if _, err := os.ReadFile(path); err == nil {
+					t.Skip("test process can read files without permission bits")
+				}
 			},
 			wantErr: "read secret file",
 		},