fix: harden system dirs at install; keep sudo attribution without passwd

Address remaining review comments:

- shim: force root:root 0755 on the managed system dirs (shim tree and
  profile.d) after MkdirAll. A pre-created dir with weaker ownership,
  possible under Debian's group-writable /usr/local/lib, would let a
  non-root user replace the shims every account executes.

- audit: when SUDO_USER has no passwd entry (minimal containers),
  attribute cloud events from sudo's recorded SUDO_USER/SUDO_UID env
  instead of falling back to root. Still gated on euid 0.

- setup: reword the root-without---system warning; alias/shim install
  follows HOME, so claiming it configures only root's home was wrong.

- shim: skip the non-root-owner validation test on Windows, where file
  ownership is not resolvable.

internal/shim/shim.go

@@ -76,6 +76,14 @@ func (m *ShimManager) Install() error {
 		return fmt.Errorf("failed to create shim directory %s: %w", m.config.BinDir, err)
 	}
 
+	if m.config.ManageProfile {
+		for _, dir := range []string{filepath.Dir(m.config.BinDir), m.config.BinDir} {
+			if err := secureSystemDir(dir); err != nil {
+				return err
+			}
+		}
+	}
+
 	for _, pm := range m.config.PackageManagers {
 		if err := m.writeShimScript(pm); err != nil {
 			return fmt.Errorf("failed to write shim for %s: %w", pm, err)