Function apply_file_patch 

pub async fn apply_file_patch(
    pkg_path: &Path,
    file_name: &str,
    patched_content: &[u8],
    expected_hash: &str,
) -> Result<(), Error>

Apply a patch to a single file.

Permission policy (per the user-visible contract — patched files must look identical to pre-patch perms-wise):

1. Existing file. Snapshot mode + owner + group before writing. If the file is read-only, temporarily grant owner-write so the overwrite succeeds (e.g. Go’s module cache marks sources read-only). After the write, restore the exact original mode and chown back to the pre-patch uid/gid. Owners stay put even when tokio::fs::write truncates and rewrites.

2. New file (created by the patch). Inherit owner + group from the parent directory and force mode 0o444 (read-only for all). Mirrors how an unpacked tarball treats new package files — consumers expect package sources to be read-only by default.

On Windows there is no uid/gid, so the owner/group step is a no-op; the read-only attribute is preserved on existing files and set on new files to honor the read-only-by-default policy.

Writes the patched content and verifies the resulting hash.