test(watch): use a Windows byte lock to reject data reads

internal/testutil/filesystem_windows.go

@@ -29,7 +29,26 @@ func denySharing(t *testing.T, name string, share uint32) func() {
 
 func DenyRead(t *testing.T, name string) func() {
 	t.Helper()
-	return denySharing(t, name, 0)
+	path, err := windows.UTF16PtrFromString(name)
+	if err != nil {
+		t.Fatal(err)
+	}
+	handle, err := windows.CreateFile(path, windows.GENERIC_READ, windows.FILE_SHARE_READ|windows.FILE_SHARE_WRITE, nil, windows.OPEN_EXISTING, 0, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	release := sync.OnceFunc(func() {
+		if err := windows.CloseHandle(handle); err != nil {
+			t.Error(err)
+		}
+	})
+	t.Cleanup(release)
+	// A byte-range lock denies data reads while leaving directory enumeration and file attributes readable.
+	var position windows.Overlapped
+	if err := windows.LockFileEx(handle, windows.LOCKFILE_EXCLUSIVE_LOCK|windows.LOCKFILE_FAIL_IMMEDIATELY, 0, 1, 0, &position); err != nil {
+		t.Fatal(err)
+	}
+	return release
 }
 func DenyReplace(t *testing.T, name string) func() {
 	t.Helper()