fix: harden system dirs at install; keep sudo attribution without passwd

Address remaining review comments:

- shim: force root:root 0755 on the managed system dirs (shim tree and
  profile.d) after MkdirAll. A pre-created dir with weaker ownership,
  possible under Debian's group-writable /usr/local/lib, would let a
  non-root user replace the shims every account executes.

- audit: when SUDO_USER has no passwd entry (minimal containers),
  attribute cloud events from sudo's recorded SUDO_USER/SUDO_UID env
  instead of falling back to root. Still gated on euid 0.

- setup: reword the root-without---system warning; alias/shim install
  follows HOME, so claiming it configures only root's home was wrong.

- shim: skip the non-root-owner validation test on Windows, where file
  ownership is not resolvable.

internal/audit/cloud_sink.go

@@ -129,6 +129,9 @@ func invokingUser() *user.User {
 			if u, err := user.Lookup(name); err == nil {
 				return u
 			}
+			// No passwd entry for the sudo user (minimal containers): keep
+			// the attribution sudo recorded rather than reporting root.
+			return &user.User{Username: name, Uid: os.Getenv("SUDO_UID")}
 		}
 	}
 	u, err := user.Current()

internal/audit/cloud_sink_test.go

@@ -180,3 +180,17 @@ func TestInvokingUserIgnoresSudoUserWhenNotElevated(t *testing.T) {
 	require.NotNil(t, got)
 	assert.Equal(t, current.Username, got.Username)
 }
+
+func TestInvokingUserKeepsSudoAttributionWithoutPasswdEntry(t *testing.T) {
+	orig := auditGeteuid
+	t.Cleanup(func() { auditGeteuid = orig })
+
+	auditGeteuid = func() int { return 0 }
+	t.Setenv("SUDO_USER", "no-such-user-xyz")
+	t.Setenv("SUDO_UID", "4242")
+
+	got := invokingUser()
+	require.NotNil(t, got)
+	assert.Equal(t, "no-such-user-xyz", got.Username)
+	assert.Equal(t, "4242", got.Uid)
+}