fix(bucket): walk AppContainer traverse grants to the volume root

[KrisPowers]

Summary

• grant_ancestor_traverse_access was capped at a fixed ancestor depth, on the theory that only directories near the workspace needed the AppContainer traverse ACE. Confirmed against a real, live-broken install that this was wrong: the filesystem driver checks traverse access on every directory in the path, and a single missing grant anywhere above the capped depth breaks the whole chain even when everything below it is correctly configured.
• This is the actual root cause of issue Windows Bucket: PowerShell default shell fails to resolve workspace cwd for deeply nested data dirs #16, which was investigated three times and closed as completed without ever actually being fixed.
• Now walks every ancestor up to and including the volume root, memoized per-directory (not a single once-ever flag, since the test suite creates a fresh temp data dir per test within one process, and a blind flag would let whichever test runs first starve every other test's own workspace tree).
• Failures now log at error level with an exact manual icacls command, since granting the drive root and the user's profile root requires an elevated token and a silent failure there previously gave no hint why PowerShell steps were breaking.

Test plan

• cargo test -p atk-bucket --lib -- --test-threads=1 windows:: — 12/12 pass, including the ACL-accumulation regression test
• Verified live on a real broken install: the traverse chain was correctly granted everywhere from the workspace up through the user's profile folder, but C:\Users and C:\ itself were not, which alone reproduced the failure
• Full end-to-end validation (a real job run succeeding) is blocked on a one-time elevated icacls grant on the host, since this session and the running service both lack the elevation needed to write ACEs on C:\ and C:\Users