Fix KWin payload permissions after verified upgrades

[Staphylococcus]

Summary

A normal 1.9.0 → 1.10.0 update leaves the installed KWin source directory root-owned with mode 700 and its files with mode 600. The desktop user's native inspector then fails to open source/CMakeLists.txt with EACCES, producing the Plasma setup error in #300.

Normalize directory and file permissions after copying the KWin payload into the system installation, retaining mode 755 for the two launchers. The updater's private staging permissions remain unchanged. Extend the existing cross-version smoke to stage the complete KWin tree privately and check installed permissions directly.

Scope

• This PR addresses one concern only.
• I split unrelated fixes, refactors, cleanup, or formatting into separate PRs.
• I read CONTRIBUTING.md and the relevant docs linked there.
• I discussed design-sensitive changes first, or this is a small obvious bug fix.

User-Visible Behavior

Upgrading through a verified release bundle keeps the installed KWin payload readable by the desktop user, so Plasma status inspection succeeds without a manual reinstall. Saved configuration, pairing and KWin configuration are preserved.

Validation

• The extended cross-version test fails against the original 1.10.0 installer on the installed source directory's mode and passes with this fix, using the pinned public 1.4.0-beta.2 baseline.
• Disposable Arch Plasma Wayland VM, KWin 6.7.5 / Qt 6.11.2: installed public 1.9.0, then ran the patched install.sh --upgrade with public 1.10.0 binaries and the released updater's private staging modes. Both the compatibility helper and native kwin-setup --status returned 0. All installed KWin directories/files had the expected permissions and root ownership; staging remained private, saved configuration/credentials were unchanged, and the published assessment had no Plasma failure.
• scripts/test-installer-first-run.sh and scripts/test-installer-graphical-auth.sh passed.
• bash -n install.sh scripts/test-cross-version-upgrade.sh and git diff --check passed.

Full CI is pending; this PR is a draft until the suite passes. The Plasma verification exercises the installer handoff with published binaries, not a newly published release. The separate service-hook assessment mismatch remains outside this fix.

Related Issue

Fixes #300