fix(docker): skip redundant chown for remapped UID

[sarvesh1327]

Summary

• Stop treating any non-default HERMES_UID/PUID as an unconditional reason to recursively chown Hermes-managed directories on every boot.
• Split data-volume and install-tree ownership repair into current-owner probes so remapped UID containers still fix first-boot mismatches but skip expensive repeated chown -R once ownership already matches.
• Add static regression coverage for the stage2 hook ownership decision.

Test Plan

• PYTHONPATH=. python -m pytest tests/test_docker_stage2_hook.py -q
• sh -n docker/stage2-hook.sh
• ruff check tests/test_docker_stage2_hook.py

Closes #35025

[alt-glitch]

Competes with #35027 — both fix #35025 (stage2-hook.sh needs_chown triggers chown -R on every boot with non-default PUID). #35027 takes a simpler approach (remove the redundant heuristic branch); this PR splits data-volume and install-tree ownership repair with stat probes.

[benbarclay]

Superseded by #35027 (merged in 1031031). Both PRs solve the same problem — stop treating a non-default HERMES_UID/PUID as an unconditional reason to chown -R on every boot (#35025) — by probing actual ownership instead. #35027 landed the minimal version (a single stat-based gate); this PR is a heavier reimplementation (+97/-27) that now conflicts against main.

One thing this PR does that #35027 didn't: extend the ownership probe to the $INSTALL_DIR install trees, not just $HERMES_HOME. If that's worth having on its own, happy to look at a focused follow-up. But the core redundant-chown fix is already in, so closing this as superseded. Thanks @sarvesh1327.