v0.66.0: userdata layout + shared-storage ownership convention

appbackup/userdata.go: EnsureUserdataDir (MkdirAll + explicit setgid Chmod 2775 +
chown gid 1000), UserdataSkeleton, EnsureUserdataSkeleton; linux chown/StatGID +
non-linux stubs. stackEnv injects USERDATA_PATH=<HDD_PATH>/userdata. Skeleton
pre-created on register + FileBrowser sync; deploy belt (composeExecCustomEnv on
'up') pre-creates every ${USERDATA_PATH} bind source. FileBrowser mounts userdata
(was appdata) — uid 1000 can now write into 2775 setgid. #8: migrate merge walk +
copyFile preserve source setgid+group so the convention survives MigrateAll.
Non-hollow tests incl. Linux setgid assertions + migration-preserve companion.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/appbackup/userdata_other.go

@@ -0,0 +1,11 @@
+//go:build !linux
+
+package appbackup
+
+import "os"
+
+// chownGID is a no-op off Linux (the dev machine has no POSIX group ownership). Production is Linux.
+func chownGID(path string, gid int) error { return nil }
+
+// StatGID is unavailable off Linux.
+func StatGID(fi os.FileInfo) (int, bool) { return -1, false }