feat(test-guest): allow copy mode overrides

[elezar]

Summary

Allow Nix test-guest --copy entries to include an optional bare permission mode suffix. When the suffix is omitted, the runner preserves the host file mode; when present, it passes the mode through to guest-side install -m.

Related Issue

No issue required: localized test VM infrastructure flag requested directly.

Changes

• Parse --copy as SRC:DEST[:MODE].
• Resolve the host file mode during copy validation only when MODE is omitted.
• Reuse the resolved mode during artifact installation.
• Update the test-guest README and runner option text.

Testing

• bash -n nix/test-guest/run.sh
• git diff --check
• Focused fake-runtime parser checks for omitted mode, trailing empty mode, 755, 0755, and invalid mode deferral
• mise run pre-commit passes, attempted via nix develop --command mise run pre-commit; timed out after 120s while building the dev environment
• Unit tests added/updated
• E2E tests added/updated, not run; no real VM boot exercised

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)