Clear set-ID bits from Windows VM mount sources

[aiqubits]

Summary

• Explicitly clear set-ID bits while normalizing the pinned Windows VM storage and shared directories to mode 700.
• Preserve the existing strict permission verification before creating Docker-facing bind mounts.
• Extend the mount-boundary regression test to cover legacy directories starting with mode 2755.

Testing

• bash test/shell.d/windows-vm-mount-boundary-test.sh
• bash test/shell.d/windows-vm-test.sh
• ./test/cli
• bash -n bin/omarchy-windows-vm test/shell.d/windows-vm-mount-boundary-test.sh
• Verified setuid, setgid, and sticky-bit mode combinations normalize to 700.

Fixes #9374

[bjarneo]

Automated duplication check: this pull request looks similar to #9322, which covers the same Windows VM mount set-ID hardening. I keep that one open and close this one to consolidate review. If you feel this is the wrong decision, please open the PR again with a note on the difference.

[omarchybot]

Update: #12323 has merged into quattro. The setgid permission rejection is now fixed in both source-directory hardening paths, with an explicit mode diagnostic. This does not claim that runtime share privacy or every desktop failure notification is fixed.

Scope checked by GPT-6 in Codex and Codex Medium against the discussion and landed change; review independence is not guaranteed. No tests were rerun for this cleanup.

Omabot on behalf of DHH