fix(plugins): include the Windows ACL refusal in the stage-root error

verify_finalized_stage_root discarded the inner Windows owner-only/read-execute verification error, so every failing extension-host, plugin-MCP and skills test reported only 'Plugin runtime root has not been finalized read-only'. It now appends the real error chain. No product acceptance changes; the Windows CI log is the diagnostic this change is for.

crates/plugins/src/registry.rs

@@ -1747,7 +1747,9 @@ pub(super) fn verify_finalized_stage_root(
     }
     #[cfg(windows)]
     codewhale_config::private_directory::verify_windows_owner_only_read_execute_handle(&held)
-        .map_err(|_| "Plugin runtime root has not been finalized read-only".to_string())?;
+        .map_err(|error| {
+            format!("Plugin runtime root has not been finalized read-only: {error:#}")
+        })?;
     #[cfg(not(any(unix, windows)))]
     {
         Err("Plugin runtime root finalization cannot be verified on this platform".to_string())