Record special bits in store identity

[jhuntwork]

New packages use manifest.v3 and a domain-separated v3 content hash.

Before v3, Mere preserved setuid, setgid, and sticky bits when packaging and extracting files, but did not include them in the content hash. That created a semantic hole: two packages could share the same store identity while behaving differently.

For example:

• A normal executable and a setuid executable could hash identically.
• A shared directory could gain or lose setgid behavior without changing identity.
• A sticky shared directory such as /tmp could hash like an ordinary writable directory.
• Verification could report success despite those meaningful permission bits drifting.

V3 closes that gap by including the three special bits for regular files and directories in the hash. It deliberately continues excluding ownership and ordinary read/write permissions because those are changed by installation context and hardening. Symlink modes remain excluded because they are not meaningful on Linux.