fix(secrets): compile outside Unix and without a redundant cast

Two build breaks in the previous commit, both invisible on macOS.

`StoreFile` and `advisory_locking_unavailable` were `#[cfg(unix)]`, but
`open_private` takes the role on every target and the write path calls the
predicate everywhere, so `codewhale-secrets` did not compile for Windows:

    error[E0433]: cannot find `StoreFile` in `file_lock`
      --> crates/secrets/src/lib.rs:627:73
    error[E0425]: cannot find type `StoreFile` in this scope
      --> crates/secrets/src/file_lock.rs:10:11
    error[E0433]: cannot find type `StoreFile` in this scope
      --> crates/secrets/src/file_lock.rs:242:72
    error[E0425]: cannot find function `advisory_locking_unavailable`
      --> crates/secrets/src/file_lock.rs:252:23

The role is a plain enum and is meaningful wherever it is passed, so it is no
longer gated. Windows takes real `LockFileEx` locks through `fd-lock`, so a
failed write lock there is genuine contention and the predicate answers false
rather than falling back to the in-process guard. `require_private_mode` stays
Unix-only, with a `let _ = role` on the other targets where nothing reads it.

`libc::stat.st_mode` is `mode_t`, which is `u16` on Apple and `u32` on Linux, so
`as u32` was a widening cast on macOS and a no-op on Linux that clippy rejects
under the workspace's `-D warnings`:

    error: casting to the same type is unnecessary (`u32` -> `u32`)
      --> crates/config/src/private_directory.rs

`u32::from` is total for both widths, and for the 32-bit Android target that is
`u16` too.

Verified on refs/pull/7168/head 95783672bf with both changes applied:
`cargo check -p codewhale-secrets --lib --target x86_64-pc-windows-msvc` fails
with the four errors above without them and passes with them;
`cargo clippy -p codewhale-secrets -p codewhale-config --lib -- -D warnings`
passes on the host; `cargo test -p codewhale-secrets` 55 passed, 1 ignored, 1
passed; `cargo fmt --all --check` clean. The Linux clippy run itself was not
executed here — cross-compiling this workspace needs a Linux `libdbus-sys`
build script — so the cast fix rests on `mode_t`'s declared width in libc
0.2.191 (`bsd/apple: u16`, `linux_like/linux: u32`) rather than a Linux run.

Signed-off-by: CodeWhale Bot <[email protected]>

crates/config/src/private_directory.rs

@@ -466,7 +466,7 @@ fn libc_uid(metadata: &libc::stat) -> u32 {
 
 #[cfg(unix)]
 fn libc_mode(metadata: &libc::stat) -> u32 {
-    metadata.st_mode as u32
+    u32::from(metadata.st_mode)
 }
 
 /// Answers already obtained from a filesystem, keyed by the identity of the

crates/secrets/src/file_lock.rs

@@ -40,6 +40,8 @@ pub(crate) fn open_private(
     }
     #[cfg(unix)]
     require_private_mode(&file, path, role)?;
+    #[cfg(not(unix))]
+    let _ = role;
     #[cfg(windows)]
     {
         use std::os::windows::fs::MetadataExt;
@@ -57,7 +59,6 @@ pub(crate) fn open_private(
 /// The distinction decides whether a wider-than-`0600` mode is repaired or
 /// refused, and it is not cosmetic: one file carries the secret and the other
 /// carries nothing.
-#[cfg(unix)]
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub(crate) enum StoreFile {
     /// `secrets.json`. A mode that let another user in means the bytes may no
@@ -279,6 +280,13 @@ fn advisory_locking_unavailable(error: &std::io::Error) -> bool {
     )
 }
 
+/// Windows always offers `LockFileEx` through `fd-lock`, so a failed write
+/// lock there is genuine contention, never an absent advisory lock.
+#[cfg(not(unix))]
+fn advisory_locking_unavailable(_error: &std::io::Error) -> bool {
+    false
+}
+
 /// Serialises secret-store writers inside this process when the filesystem
 /// offers no advisory lock. Coarse on purpose: store writes are rare and short.
 fn in_process_write_guard() -> std::sync::MutexGuard<'static, ()> {