Allow verified Windows sticky mount roots

[crohr]

Summary

• allow the Windows sticky root when mountvol verifies it as an active volume mount
• keep strict link rejection for every path below the sticky root
• add a Windows regression test and rebuild the distributed action binaries

Root cause

Windows exposes C:\\runs-on\\stickydisk as an NTFS volume-mount reparse point. The new persisted-path hardening used Lstat on the mount root and rejected that legitimate mount before creating any cache source directories.

The workflow then logged a warning, skipped cache setup, and failed because windows-cache was never created.

Impact

Windows custom sticky caches can use the verified mounted volume again without weakening protection against restored junctions or symlinks inside cache state.

Validation

• go test ./internal/stickydisk
• go vet ./internal/stickydisk
• Windows test package cross-compilation with GOOS=windows GOARCH=amd64
• rebuilt Linux amd64, Linux arm64, and Windows amd64 action binaries
• adversarial review found no substantive correctness, security, performance, regression, or test-gap issues