v0.66.0: userdata layout + shared-storage ownership convention

appbackup/userdata.go: EnsureUserdataDir (MkdirAll + explicit setgid Chmod 2775 +
chown gid 1000), UserdataSkeleton, EnsureUserdataSkeleton; linux chown/StatGID +
non-linux stubs. stackEnv injects USERDATA_PATH=<HDD_PATH>/userdata. Skeleton
pre-created on register + FileBrowser sync; deploy belt (composeExecCustomEnv on
'up') pre-creates every ${USERDATA_PATH} bind source. FileBrowser mounts userdata
(was appdata) — uid 1000 can now write into 2775 setgid. #8: migrate merge walk +
copyFile preserve source setgid+group so the convention survives MigrateAll.
Non-hollow tests incl. Linux setgid assertions + migration-preserve companion.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/appbackup/userdata_linux.go

@@ -0,0 +1,20 @@
+//go:build linux
+
+package appbackup
+
+import (
+	"os"
+	"syscall"
+)
+
+// chownGID sets the GROUP of path (owner unchanged via -1). Setting an arbitrary group requires
+// CAP_CHOWN; the in-guest controller runs as root, so this succeeds in production.
+func chownGID(path string, gid int) error { return os.Chown(path, -1, gid) }
+
+// StatGID returns the owning GID of fi (Linux). ok=false when the underlying stat is unavailable.
+func StatGID(fi os.FileInfo) (int, bool) {
+	if st, ok := fi.Sys().(*syscall.Stat_t); ok {
+		return int(st.Gid), true
+	}
+	return -1, false
+}