[parawanderer]

Branched from main, so it is independent of #106 and can go in either order.

Reading a secret from a file did not work on Windows at all

secrets.py refuses a file with the group or other read bits set and tells the user to run
chmod 600. Measured, not inferred:

mode: 0o100666
S_IRGRP set: True   S_IROTH set: True
after chmod 600: 0o100666 -> group/other readable: True

CPython synthesises st_mode as 0o666 for every regular file on Windows, and os.chmod cannot
clear those bits. So the guard was true of every file on the system — the safest way to pass a
secret was unusable on a platform this ships a binary for, and the advice it printed could not
change the answer.

The check is now skipped where the bits carry no information, rather than approximated. Real
permissions there are ACLs, which stat cannot see; reading them needs icacls or pywin32, which
is a large dependency for a guard that is advisory even on POSIX. Leaving it was not the safer
option — it made the best input route impossible and pushed people to the environment variable,
which the module's own docstring ranks as worse. POSIX behaviour is untouched.

Two tests were passing for the wrong reason

This is the part worth reviewing. Of the three permission tests, two assert that an insecure file
is refused — and on Windows they passed, because every file was refused. Green ticks over an
assertion that could not fail.

They are skipped there now, with a reason that says so. The third failed for a second, unrelated
cause: pytest.raises(match=...) is a regex and a Windows path is full of backslashes, so it needs
re.escape.

test_device.py had the same shape — it asserts the stored device identity is readable by its
owner alone, which chmod cannot arrange there. Skipped, and device.py now says plainly that its
chmod is a no-op on Windows instead of leaving it to look like protection.

The marker lives in test/unittestutils.py beside skip_unless_unix, which is where this repo
already keeps these.

Result

	Before	After
Windows	8 failures	435 passed, 8 skipped, 0 failures
POSIX	unchanged	unchanged — os.name != "nt" and …

POSIX is unchanged by construction, and CI proves it: the four skipped tests are exactly the ones
that run there, so if the guard had been weakened they would go red.

Also: the handover doc back in line with the code

docs/android-import-handover.md had drifted into being confidently wrong.

• §6's three outstanding items have shipped — the pin, the serial, the iPhone model.

• The device-name ask is dropped, not pending. announce_device needs the
  com.apple.gs.idms.hb heartbeat token, which an account serialised before FindMy.py started
  keeping it does not have. Making it work means those users signing in again, which is not worth
  a re-login for a label.

• §4 no longer asks for a Room migration. OwnedBeacons.content is already nullable in schema
  3, so a key-list tag is a row with accessory_json set and content NULL. No new column, no
  migration, and rule 1 does not come into it.

  The risk moved rather than vanished, and the note now names where: BeaconRepository already
  tolerates a NULL plist, but BeaconDataParser reads getOwnedBeaconInfo().content straight into
  an XML parse, and a custom tag has no naming record either — its display name is the name in
  its own mapping.