Windows: secrets permission check always warns (st_mode does not reflect NTFS ACLs)

Summary

On Windows the secrets-permission check can never pass, so every session prints a warning the user has no way to clear.

Environment

• Windows 10, installed as a Claude Code plugin (watch@claude-video 0.2.0)
• Native Windows Python 3.12 (not WSL); Git Bash runs the SessionStart hook
• Setup is otherwise healthy: setup.py --json reports "status": "ready", "can_proceed": true

What happens

Both the hook and setup.py warn on every run:

/watch: WARNING — /c/Users/natio/.config/watch/.env has permissions 644 (should be 600).
  Fix: chmod 600 /c/Users/natio/.config/watch/.env

[watch] WARNING: C:\Users\natio\.config\watch\.env is readable by other users. Run: chmod 600 C:\Users\natio\.config\watch\.env

Why the user can't fix it

On Windows, os.stat().st_mode is not derived from the NTFS ACL — CPython synthesizes it from the read-only attribute, so an ordinary file always reports 0o644/0o666. MSYS/Git Bash stat -c '%a' reports the same. Consequences:

• chmod 600 is a no-op — verified: before=644 → chmod 600 → after=644
• Even after locking the file down to the owner account only, both checks still report 644:
  复制

  icacls .env /inheritance:r /grant:r "natio:(F)"

So the file genuinely is private, but neither check can observe that. The warning is unavoidable on every Windows install.

Related: CONFIG_FILE.chmod(0o600) (setup.py:136, setup.py:161) also silently does nothing on Windows, so a fresh Windows install starts in the "failing" state by construction.

Suggested fix

Skip the mode check where it can't carry meaning:

• skills/watch/scripts/setup.py:71 — early-return from _check_file_permissions() when platform.system() == "Windows"
• hooks/scripts/check-setup.sh — guard the stat block, e.g. [[ "$OSTYPE" != msys* && "$OSTYPE" != cygwin* && "$OSTYPE" != win32 ]]

If you'd rather keep real coverage on Windows, the equivalent signal is the ACL (icacls output, or win32security) rather than the mode bits.

Happy to send a PR if that would help.