test(workspace): create the descendant on disk; write the grant via cbm_fopen

The Windows half of ws_approve_sensitive_matches_across_separator_styles
asserted the sensitive-root hint for <cache>/.ssh/cfg/sub without creating
that directory. Containment canonicalizes the candidate, which on Windows
opens it (CreateFileW, OPEN_EXISTING), so a missing descendant was reported
as outside the allowed root and the assertion failed on the Windows shard.
Create it the way its parent is created.

The grant file is now written through cbm_fopen, the wrapper every
repository or user path goes through, in binary mode.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

tests/test_workspace.c

@@ -452,7 +452,7 @@ TEST(ws_approve_sensitive_matches_across_separator_styles) {
 
     char grant[2048];
     snprintf(grant, sizeof(grant), "!%s\\.ssh\\cfg\n", cache);
-    FILE *f = fopen(path, "w");
+    FILE *f = cbm_fopen(path, "wb");
     ASSERT_NOT_NULL(f);
     (void)fprintf(f, "%s", grant);
     (void)fclose(f);
@@ -495,6 +495,10 @@ TEST(ws_approve_sensitive_matches_across_separator_styles) {
             *p = '/';
         }
     }
+    /* Containment canonicalizes the candidate, which on Windows opens it
+     * (CreateFileW, OPEN_EXISTING): a descendant that is not on disk is
+     * "outside the allowed root" instead of reaching the sensitive hint. */
+    ASSERT_TRUE(cbm_mkdir_p(descendant, 0700));
     err[0] = '\0';
     ASSERT_FALSE(cbm_workspace_root_allowed(descendant, NULL, cache, NULL, err, sizeof(err)));
     ASSERT_TRUE(strstr(err, "--approve-sensitive") != NULL);