## What happened

`omarchy windows vm launch` exits with `❌ Failed to start Windows VM!` even though the VM itself is healthy. `omarchy windows vm status` reports the container as stopped/exited, and re-running launch keeps failing.

## Root cause

`omarchy-windows-vm`'s `prepare_caller_mounts()` runs this privacy preflight on the user's mount sources (`~/.windows` and `~/Windows`):

```bash
chmod 0700 -- "/proc/$BASHPID/fd/$storage_fd" "/proc/$BASHPID/fd/$shared_fd"
storage_mode=$(stat -Lc '%a' ...)
shared_mode=$(stat -Lc '%a' ...)
if [[ $storage_mode != 700 || $shared_mode != 700 ]]; then
  return 1
fi
```

The check assumes `chmod 0700` results in mode `0700`. On Linux that is true for **files**, but **not for directories**: `chmod 0700` does not clear the setgid bit on a directory (only `chmod g-s` does). Verified on this system:

```bash
$ mkdir d && touch f && chmod 2755 d f
$ chmod 0700 d f
$ stat -c '%a %A %n' d f
2700 drwx--S--- d    # setgid survives on the directory
700  -rwx------ f    # cleared on the file
```

The setgid bit gets onto `~/Windows` because the `dockurr/windows` container's Samba setup runs `chmod 2777` on `/shared` when it is empty (`/run/samba.sh`):

```bash
elif [[ "$empty" == "Y" ]] && chmod 2777 "$dir" 2>/dev/null; then
...
# Keep newly created content in the shared group through the setgid bit.
if ! chmod 2777 "$dir"; then
```

So on first start with an empty `~/Windows`, Samba sets the setgid bit; the next `launch`'s `chmod 0700` cannot remove it, the `!= 700` check fails, and launch bails out with the generic "Failed to start Windows VM!" message.

## Steps to reproduce

1. `omarchy windows vm install` (leaves `~/Windows` empty)
2. Start the VM once and let Samba initialize `/shared` (it runs `chmod 2777`)
3. `omarchy windows vm stop`
4. `omarchy windows vm launch`
5. Launch fails; `stat -c '%a' ~/Windows` shows `2700` instead of `700`

## Expected

`launch` starts the VM.

## Actual

`launch` prints `❌ Failed to start Windows VM!` and exits 1.

## Workaround

```bash
chmod g-s ~/Windows
omarchy windows vm launch
```

(Also drop a placeholder file into `~/Windows` so Samba never sees it as empty and re-applies `chmod 2777` on the next container start.)

## Suggested fix

Clear the setgid bit explicitly on the mount sources in `prepare_caller_mounts()` (and anywhere else the script relies on `chmod 0700` on a directory), e.g.:

```bash
chmod g-s -- "/proc/$BASHPID/fd/$storage_fd" "/proc/$BASHPID/fd/$shared_fd"
```

or accept a setgid-only mode (`2xxx`) as valid in the check.

## System

- Omarchy 4.0.4-1
- Kernel 7.2.5-3-omarchy
- CPU: AMD Ryzen 7 H 255 w/ Radeon 780M Graphics
- Root filesystem: btrfs (LUKS)
- docker image: `dockurr/windows` v6.05

Full diagnostic log: `omarchy debug --no-sudo --print` (898 lines) available on request.