fix(updater): split compose owner handling by platform

[frahlg]

Accepted text proposal

Build fix found while completing the maintainer-approved forecasting work in Codex.

What changed

The Windows updater build fails after #1086 because the Compose replacement code refers to Unix's syscall.Stat_t. Move owner copying into platform files: Unix keeps the same UID/GID check and Chown call; other platforms keep the owner assigned to the staged file.

Why

make verify-all reaches the Windows build and fails at retire_python.go:330 with undefined: syscall.Stat_t. Linux builds pass. This small dependency lets forecasting PR #1089 complete all release-target build checks.

Boundaries and safety

Compose validation, backups, file modes, sync, replacement and command behavior stay the same. This does not run retirement or change a site. No open PR touched the updater files when this fix started.

Verification

• GitHub CI passed on 5450c861, including Go and full-stack tests.
• go test ./cmd/ftw-updater -count=1: passed, including replacement/ownership and rollback tests.
• go vet ./cmd/ftw-updater: passed.
• CGO_ENABLED=0 go build ./... with GOOS=linux GOARCH=arm64, GOOS=linux GOARCH=amd64 and GOOS=windows GOARCH=amd64: passed on this commit.
• make verify-all also passed with this commit as the forecasting branch's base.

Checklist

• The diff implements one accepted scope and does not add follow-on work.
• I checked open pull requests that touch the same files.
• Tests cover the changed behaviour and its failure path.
• No web/UI view changed.
• A Changeset is included.
• Every commit has a DCO sign-off.

---

Note

Low Risk
Platform-specific refactor with identical Unix behavior; no change to retirement or Compose semantics beyond fixing the Windows compile error.

Overview
Fixes the Windows ftw-updater build, which broke when Compose replacement code referenced Unix-only syscall.Stat_t.

Compose file replacement in replaceRetiredCompose now calls a shared preserveFileOwner helper instead of inlining Chown. Unix builds keep the prior behavior (copy UID/GID from the original file onto the staged temp file). Non-Unix builds use a no-op implementation so the platform’s default ownership applies.

Compose validation, modes, sync, and retirement logic are unchanged aside from this indirection. A patch changeset documents the fix.

^{Reviewed by Cursor Bugbot for commit 5450c86. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T11:23:36.499665Z	5450c86	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cursor]

Left a non-blocking comment; no reviewers were assigned. Cursor Bugbot completed with no findings, but APPROVAL_POLICY.md does not authorize auto-approval, and no CODEOWNERS path matches these updater files. Human review is still needed before merge.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}