## Bug

`omarchy-windows-vm install` fails with **"❌ Failed to write the Windows VM configuration."** when either mount source directory (`~/Windows` or `~/.windows`) carries the **setgid bit**.

## Root cause

In `prepare_caller_mounts()` (`/usr/bin/omarchy-windows-vm`, around lines 580-592):

```bash
chmod 0700 -- "/proc/$BASHPID/fd/$storage_fd" "/proc/$BASHPID/fd/$shared_fd" || { ...; return 1; }
storage_mode=$(stat -Lc '%a' "/proc/$BASHPID/fd/$storage_fd") || storage_mode=""
shared_mode=$(stat -Lc '%a' "/proc/$BASHPID/fd/$shared_fd") || shared_mode=""
if [[ $storage_mode != 700 || $shared_mode != 700 ]]; then
  ...; return 1
fi
```

The code assumes `chmod 0700` guarantees mode `700`. It does not when the setgid bit is set: the Linux kernel **preserves `S_ISGID`** on `chmod` when the caller is in the file's group or has `CAP_FSETID` (which root always has). So a directory with mode `2700` stays `2700` after `chmod 0700` (`chmod` returns 0), `stat '%a'` yields `2700`, the `!= 700` check fails, `prepare_caller_mounts` returns 1, `write_compose` fails, and install aborts.

Reproduced with a plain dir: `mkdir /tmp/t && chmod 2700 /tmp/t && chmod 0700 /tmp/t && stat -c %a /tmp/t` → still `2700`.

## Steps to reproduce

1. `mkdir -p ~/Windows && chmod 2700 ~/Windows` (e.g. leftover from an older setup/tool)
2. `omarchy-windows-vm install` (any valid config)
3. After the pkexec authorization, install aborts: `❌ Failed to write the Windows VM configuration.`
4. Root-side stderr: the run dies in `prepare_caller_mounts` with no message (the `!= 700` branch returns silently), exit 2.

## Expected

Install should succeed. A setgid bit on the shared/storage folder (which the user legitimately owns) must not block VM setup.

## Suggested fix

Explicitly clear the setgid bit before the mode check (a plain `chmod 0700` cannot be relied on):

```bash
chmod 0700 -- "/proc/$BASHPID/fd/$storage_fd" "/proc/$BASHPID/fd/$shared_fd" || { ...; return 1; }
chmod g-s -- "/proc/$BASHPID/fd/$storage_fd" "/proc/$BASHPID/fd/$shared_fd" || { ...; return 1; }
```

or compare ignoring the special bits: `(( (8#$mode & 0777) == 700 ))`.

## System

- Omarchy 4.0.2-1 (Arch Linux)
- Kernel 7.1.9-arch1-2
- btrfs root, `@home` subvolume mounted at `/home`
- User uid 1000 in `docker` group; sudoless Docker off