Clear set-ID bits from Windows VM mount sources

[aiqubits]

Summary

• Explicitly clear set-ID bits while normalizing the pinned Windows VM storage and shared directories to mode 700.
• Preserve the existing strict permission verification before creating Docker-facing bind mounts.
• Extend the mount-boundary regression test to cover legacy directories starting with mode 2755.

Testing

• bash test/shell.d/windows-vm-mount-boundary-test.sh
• bash test/shell.d/windows-vm-test.sh
• ./test/cli
• bash -n bin/omarchy-windows-vm test/shell.d/windows-vm-mount-boundary-test.sh
• Verified setuid, setgid, and sticky-bit mode combinations normalize to 700.

Fixes #9374