#3302 [TUI] Windows: owner-only check fails for the built-in Administrator (SDDL alias LA) and blocks the engine test start

说明

**Problem:** On Windows, when the Terminal runs as the built-in Administrator account (RID 500, here renamed), the owner-only check rejects a folder whose ACL this code has just set itself. `strata update` verifies engine 0.1.45.3 and then fails its test start with `ProfileError: runtime directory must be owner-only (mode 0700)`; the engine is rolled back. A managed start on the same account fails the same way.

**Environment:**
- Strata Terminal 0.2.0-beta (build 0.1.45.3), Windows x86_64, RTX 5080 (driver 617.42), no model serving during the update.
- Account: built-in Administrator, renamed; `whoami /user` shows SID `S-1-5-21-<domain>-500`.
- Engine offered: 0.1.45.3 windows-x86_64-cuda-cuda13 (signed feed sequence 101, manifest sha256 `68fa0ee7c23bb0343e57f2e7b1db61a0f44aa7835f421b396df94502859d78af`).

**Reproduce:**
1. Use an account whose SID is the built-in Administrator's (`…-500`).
2. Run `strata update` with no engine installed.
3. The package downloads, unpacks, and passes the signature and per-file check. The test start then fails:
   `Engine none NOT changed: The new engine 0.1.45.3 did not pass its test start (ProfileError: runtime directory must be owner-only (mode 0700)).`
4. The same error occurs outside the updater whenever `runtime.runtime_dir()` creates the runtime folder.

**Expected:** The test start passes; the folder is owner-only already and only this account can reach it.

**Actual:** `ProfileError`, update not installed.

**Evidence (reproduced locally, not static analysis):**
- A fresh `STRATA_RUNTIME_DIR` created through `runtime.runtime_dir()` reports this DACL:
  `D:PAI(A;OICI;FA;;;LA)`.
- `Get-Acl` on that folder resolves the single ACE to `<machine>\<user>`, SID `S-1-5-21-<domain>-500`, FullControl; `icacls` shows `<machine>\<user>:(OI)(CI)(F)`. `restrict_to_current_user()` did what it promises.
- `private_files.current_user_sid()` returns `S-1-5-21-<domain>-500`.
- `private_files.is_private()` and `is_unshared()` split the SDDL text and compare the ACE principal (`fields[5]`) with that string. Windows renders the RID-500 account as the SDDL alias `LA`, so the comparison is `"LA" == "S-1-5-21-<domain>-500"` and returns False — including immediately after this module set the protected DACL itself. `runtime.runtime_dir()` raises, so the update test start never reaches the engine.
- A local change in the installed Control package that treats `LA` as the current SID when the SID ends in `-500` makes `is_unshared()` return True; `strata update` then installs 0.1.45.3 and reports `tested: started, answered one token, stopped`.

**Suggested fix:** resolve SDDL aliases (at least `LA`) or compare binary ACE SIDs with `EqualSid` instead of comparing SDDL text. `owner_transport` calls `is_private()` and is affected the same way on such an account.

**Reproduction status:** reproduced locally on the machine described above.