# [BUG] omarchy-windows-vm launch fails silently when ~/Windows has the setgid bit set (numeric chmod cannot clear it)

## Environment

- Omarchy 4.0.2-1
- Arch Linux, kernel 7.1.9-arch1-2
- Windows VM installed via `omarchy windows vm install`, container `omarchy-windows` running and healthy (web console at 127.0.0.1:8006 shows a booted desktop; RDP answers X.224 on 3389)
- User not in the `docker` group (default), so `launch` elevates through pkexec

## What happened

```
$ omarchy windows vm launch
Starting Windows VM (this may prompt for authorization)...
❌ Failed to start Windows VM!
   Try checking: omarchy-windows-vm status
```

No reason is printed — not on the terminal, not in a notification. `status` reports RUNNING, the web console works, RDP is up; only `launch` refuses.

## Root cause

`prepare_caller_mounts()` in `omarchy-windows-vm` chmods the opened FDs of the caller's `~/.windows` / `~/Windows` and then verifies the mode:

```bash
chmod 0700 -- "/proc/$BASHPID/fd/$storage_fd" "/proc/$BASHPID/fd/$shared_fd" || ...
storage_mode=$(stat -Lc '%a' "/proc/$BASHPID/fd/$storage_fd" 2>/dev/null) || storage_mode=""
shared_mode=$(stat -Lc '%a' "/proc/$BASHPID/fd/$shared_fd" 2>/dev/null) || shared_mode=""
if [[ $storage_mode != 700 || $shared_mode != 700 ]]; then
  exec {storage_fd}<&-
  exec {shared_fd}<&-
  return 1      # <-- silent
fi
```

In my case `~/Windows` carried the setgid bit (mode `2700`, `drwx--S---`). **A numeric `chmod 0700` cannot clear setgid on a directory** — the setgid bit is left as-is (setting it via numeric mode works, clearing it doesn't; `g-s` is required). So the chmod "succeeds", the verification still reads `2700`, and the function returns 1 without any message. `launch` surfaces only the generic failure box.

Confirmed with `bash -x` under pkexec:

```
+ chmod 0700 -- /proc/396250/fd/11 /proc/396250/fd/12
++ stat -Lc %a /proc/396582/fd/11
+ storage_mode=700
++ stat -Lc %a /proc/396584/fd/12
+ shared_mode=2700
+ [[ 700 != 700 ]]
+ [[ 2700 != 700 ]]
+ exec
+ return 1
```

## Workaround

```
chmod g-s ~/Windows
```

After this, `omarchy windows vm launch` works (verified).

## Suggested fix

1. Clear the setgid bit explicitly, e.g. `chmod 700,g-s` (symbolic `g-s`), at the FD chmod in `prepare_caller_mounts()` — and audit the other numeric `chmod 0700` calls on user-owned directories (there are two more) for the same trap.
2. Print a diagnostic before returning 1 in that failure path — the silent exit makes this (and any future mode mismatch) undiagnosable from the user side.

## Reproduce

1. Install the Windows VM normally.
2. `chmod g+s ~/Windows` (any source of setgid works; mine arrived with mode 2700).
3. `omarchy windows vm launch` → generic failure, no diagnostics.