Fix real-host upgrade compatibility

[Staphylococcus]

Summary

• allow privileged upgrades through root-owned installation directories that lack an owner write bit, while retaining ownership, search, mount, and read-only-filesystem checks
• create missing updater cache directories with mode 0700 and atomic cache files with mode 0600, independent of a permissive login umask
• add regressions for Fedora-style root-owned 0555 system directories and Ubuntu-style umask 0002 cache creation

Validation

• cargo fmt --all --check
• full cargo test -p lg-buddy suite: 740 library tests plus Cucumber and integration suites
• release-bundle smoke test
• beta.2 to branch-candidate cross-version smoke test
• Fedora 44 VM: reproduced the beta.2 preflight refusal on root-owned 0555 /usr paths, then completed a real sudo/systemd branch-candidate upgrade with state preserved
• Ubuntu 24.04 VM: reproduced permissive cache modes under umask 0002, then verified the fixed client creates 0700 directories and a 0600 cache file and completes acquisition/upgrade
• Arch Linux VM: untouched public beta.2 installed and upgraded to untouched public beta.3 with real pacman, sudo, systemd, reboot, bundle parity, and state preservation

These fixes are required in 1.4.0 before starting stable release promotion.