Guard direct os.* mutations, and expose enforcement via IsRestricted / Observe.restricted #435

Epic: #430 · Feature: #405

Phase 5 of windows-native-permissions.md, and the phase where
the 28 finally moves.

Two halves:

1. The guard -- a check that fails on a deliberately reintroduced direct os.WriteFile, so the
   migration cannot silently regress.
2. Observability -- Mode().Perm() reports 0666 on Windows regardless of the DACL, so permission
   assertions cannot be written against it. IsRestricted and Observe.restricted are the portable
   surface the existing permission tests migrate onto.

Exit: the guard is live in make check; the permission tests assert through the new surface; the
windows leg's failure count moves for the first time, and the new number is recorded name-for-name.