Keep WSL gateway startup working when chmod reports EROFS

OpenClaw 2026.7.1 could fail during gateway startup on WSL2 because the subagent and task registries attempted to chmod the state directory and Node returned EROFS, even when the directory already had restrictive 0700 permissions.

Updated the private-mode helper to treat EROFS as non-fatal only after stat confirms the target already has restrictive permissions. Broad state-directory permissions, unexpected chmod failures, and existing EPERM or unsupported-filesystem behavior remain fail-closed.

• Restores gateway startup for WSL2 users whose state directory is already private.
• Avoids weakening OpenClaw state-directory hardening by refusing to ignore EROFS on broad permissions.
• Keeps the fix narrowly scoped to the production state-database open path and shared private-mode helper.

• Added state database coverage that opens when EROFS leaves existing permissions restrictive.
• Added negative coverage proving EROFS is rethrown when the state directory is too broad.
• PR evidence covered the reporter's WSL2 environment, hosted checks, and unchanged EPERM and unsupported-filesystem paths.