fix: set sticky bit on the default directory

[HeRaNO]

Describe your changes.

---

• I've followed the contribution guidelines.
• I've signed the CLA.
• I've successfully run make lint && make test.
• I've added or updated any relevant documentation.
• In documents I changed, I added a meta description if one was missing.
• I've updated the relevant release notes.

Fixes #1170.

/var/lib/pebble/default is intentionally world-writable so that Pebble can create its socket and state files when a rock uses a non-root run-user. However, mode 0777 allows users to remove or rename entries owned by other users and is reported by insecure world-writable-directory checks.

Set the directory mode to 01777, preserving non-root write access while protecting directory entries with the sticky bit.

The mode is updated in both paths that create the directory:

• the implicit Pebble part, including rocks without services or checks;
• the layer generated when services or checks are present.

Tests now verify the complete mode with stat.S_IMODE instead of inspecting only the final three octal digits. Spread coverage checks the resulting image both with and without a generated Pebble layer, while retaining the existing non-root file-creation check.

After this is released, affected base images must be rebuilt and republished; the change cannot alter permissions in already-published OCI layers.