fix(sync): harden mutagen target permissions for developer mounts

[joshavant]

Summary

• stop creating world-writable developer sync trees in _prepare_remote_mutagen_targets
• add explicit recursive o-w remediation on each synced guest path during sync target preparation
• extend orchestrator edge coverage to assert no a+rwX usage and required non-world-writable chmod clauses
• extend integration coverage to assert synced guest paths are not world-writable after developer up
• document the regression fix under Unreleased in CHANGELOG.md

Validation

• Ran ./scripts/ci/run.sh fast
• Ran ./scripts/ci/run.sh logic
• Ran ./scripts/ci/run.sh integration (if macOS + Tart environment was available)