isolate user data with personal group ownership

- chown user dirs to pastilhas:<username> instead of pastilhas:officerdev
  so users cannot access each other's data
- chmod 2770 (setgid) gives only the owning user terminal access
- setup.sh: ensure home dir is traversable (o+x) for provisioned users

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/setup.sh

@@ -63,6 +63,14 @@ else
   ok "added $USER to officerdev group"
 fi
 
+# Ensure provisioned users can traverse to data directories
+if [ "$(stat -c '%A' "$HOME" | cut -c10)" = "x" ]; then
+  skip "home dir traversable"
+else
+  chmod o+x "$HOME"
+  ok "made home dir traversable (o+x)"
+fi
+
 # ─── 1. core system packages ───────────────────────────────────────────────────
 echo ""
 echo "── Core system packages ──"