fix: support private-group Direct WSS parents

[twilightsaurus]

Summary

Fix Direct WSS provisioning on ordinary Ubuntu user-private-group layouts where ~/.config and systemd config ancestors are 0775.

• permit group-writable Direct WSS ancestor directories only when the enumerated account/group database shows the owning primary group is private to the target user
• reject shared groups, duplicate-GID membership, world-write, foreign ownership, symlinks, and extended access ACLs
• keep ~/.config/imp strictly 0700 and gateway.env strictly 0600
• report path-safety failures separately from gateway.env syntax failures
• document NSS enumeration limitations
• add focused and packaged-bundle regressions for Ubuntu-style ancestors

Background

Slice 24 live acceptance of v0.3.0 found that imp-direct-wss rejected the production VPS because Ubuntu's normal umask 002 layout had 0775 ancestors under ~/.config.

Live acceptance stopped before setup or credential rotation. No production permissions or credentials were changed.

Validation

• Direct WSS tests: 77 passed, including real POSIX ACL coverage
• npm run relay:lint: passed
• npm run check: passed
• server-bundle acceptance: passed
• git diff --check: clean

Independent review: APPROVE.