Add Win32 NTFS Owner view to the Cygwin ownership-display step

The ownership-display step on `cygwin-test.yml` previously reported
file ownership only via Cygwin's `ls -ld`. That goes through Cygwin's
SID-to-uid mapping (well-known SIDs by RID; machine-local accounts by
`0x30000 + RID`). The mapping is deterministic and reversible, so in
principle one can recover the actual NTFS Owner SID from what Cygwin
prints. But it is a step removed from a direct Win32-API observation,
and that distance has made several preceding diagnostic experiments
in this chain effectively "Cygwin's view of NTFS ownership," not
direct verification that what Cygwin calls `Administrators` really
is `BUILTIN\Administrators` (S-1-5-32-544) and what it calls
`runneradmin(197108)` really is the local Administrator account
(S-1-5-21-...-500).

Add a parallel block to the same step that uses Cygwin's interop to
shell out to `powershell.exe -Command "(Get-Acl ...).Owner"` for the
same set of paths. The output is the NTAccount form
(`BUILTIN\Administrators`, `<machine>\runneradmin`, etc.) of the
SID Win32 itself records, with no Cygwin layer in between.

This is a permanent addition to the kept ownership-display step --
having both views side by side in every Cygwin CI run is more
informative than either alone, and serves as a built-in sanity check
on Cygwin's mapping in case it ever drifts.

The corresponding step in `pythonpackage.yml` (Windows-native) uses
Git Bash MSYS2 `ls`, which has the same class of indirection and
arguably benefits from the same enhancement -- left for a follow-up
if useful, since the load-bearing observations for the bug this
chain fixes are all on the Cygwin runner.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: EliahKagan

.github/workflows/cygwin-test.yml

@@ -84,7 +84,7 @@ jobs:
 
     - name: Show file ownership and safe.directory entries
       run: |
-        echo "==================== File ownership ===================="
+        echo "==================== File ownership (Cygwin view, ls -ld) ===================="
         for p in \
             "$(pwd)" \
             "$(pwd)/.git" \
@@ -99,6 +99,40 @@ jobs:
           fi
         done
         echo
+        echo "==================== File ownership (Win32 view, Get-Acl) ===================="
+        # Cygwin's ls -ld and stat go through Cygwin's SID-to-uid mapping
+        # (well-known SIDs by their RID, machine-local accounts by 0x30000+RID).
+        # The mapping is deterministic, but going via Win32 Get-Acl gives the
+        # NTAccount form of the NTFS Owner SID directly, with no Cygwin layer
+        # in between -- useful for confirming that what Cygwin reports as
+        # "Administrators" really is the BUILTIN\Administrators SID (S-1-5-32-544)
+        # rather than some local-machine account that Cygwin happens to map to
+        # the same uid. The workflow sets CYGWIN_NOWINPATH=1, so Windows paths
+        # are not on Cygwin's $PATH; invoke powershell.exe by absolute path.
+        ps_exe=/cygdrive/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe
+        if [ -x "$ps_exe" ]; then
+          for p in \
+              "$(pwd)" \
+              "$(pwd)/.git" \
+              "$(pwd)/git/ext/gitdb" \
+              "$(pwd)/git/ext/gitdb/.git" \
+              "$(pwd)/git/ext/gitdb/gitdb/ext/smmap" \
+              "$(pwd)/git/ext/gitdb/gitdb/ext/smmap/.git" \
+              "${HOME:-}/.gitconfig"; do
+            if [ -n "$p" ] && [ -e "$p" ]; then
+              wp=$(cygpath -w "$p")
+              # Escape single-quotes for PowerShell single-quoted string literal: ' -> ''
+              wp_escaped=${wp//\'/\'\'}
+              owner=$("$ps_exe" -NoProfile -NonInteractive -Command \
+                "try { (Get-Acl -LiteralPath '${wp_escaped}').Owner } catch { 'ERROR: ' + \$_.Exception.Message }" \
+                2>/dev/null | tr -d '\r')
+              printf "  %-44s  %s\n" "$owner" "$wp"
+            fi
+          done
+        else
+          echo "($ps_exe not found -- skipping Win32 view)"
+        fi
+        echo
         echo "==================== safe.directory entries ===================="
         git config --global --get-all safe.directory 2>&1 || echo "(none)"