[inureyes]

The _WIN32 branches of jit_module.cpp loaded modules from a cache directory they never checked. Per item in #2797:

1. Windows trust check. ptx_cache_dir_win.h and ptx_cache_acl_win.h apply the rules of hsaco_cache_dir_win.h to MLX_PTX_CACHE_DIR, the persistent default, the temp fallback and the device subdirectory. The walk removes the \\?\ prefix, because std::filesystem otherwise parses \\? as the root and walks past the drive; file system calls add it back, so paths past MAX_PATH still work.
2. Relative paths. A relative MLX_PTX_CACHE_DIR or MLXCEL_CACHE_DIR is refused on all platforms, and ensure_persistent_ptx_cache no longer creates directories under the current directory.
3. POSIX repair. make_private_dir clears group write only, and other write stays for the overlay to refuse.
4. Empty root. cache_root treats an empty MLXCEL_CACHE_DIR as unset.

From review, on CUDA and ROCm unless noted:

• Each entry file passes the same rules on load, through one handle, or it is a miss that recompiles and republishes.
• FILE_WRITE_ATTRIBUTES joins the write mask, and TrustedInstaller is trusted like SYSTEM, so a service profile under C:\Windows can cache.
• An empty MLX_PTX_CACHE_DIR counts as unset (CUDA).

Behavior changes on Windows, not in the issue. The persistent default never took effect: Rust's set_var does not reach the C runtime's getenv, so entries went to %TEMP%\mlx and cuda-ptx/<commit> stayed empty, measured with the main binary. The overlay now reads the process environment, so mlxcel and mlxcel-server use the documented directory and compile once after upgrading. Anyone who set MLX_PTX_CACHE_DIR= to turn the cache off now gets the default directory.

Validation

On the Windows N1X with real icacls ACLs:

• tests/cuda_ptx_cache_trust_windows.rs: 15 of the first 19 cases failed on the old overlay, and all 22 pass now. Planted entries load from a private directory (the control), and do not load from a shared one or with a foreign write entry on the file.
• mlxcel generate: a default directory compiles, then hits. A root inheriting Authenticated Users write prints ... is writable by S-1-5-11 and compiles with warm entries planted. A grant on one entry recompiles, then hits. A relative root is refused and nothing is created.
• mlxcel-server (before the review fixes): a shared root is refused. A private root compiles, then hits.
• One mutant each against the host tests: every right out of the mask on both headers, the entry check, the owner and null DACL rules, TrustedInstaller, and the subdirectory trust call. All 27 fail.

In CI: overlay-host-tests-windows runs both host tests on windows-latest without a GPU, and cpu-link now runs the ptx_cache_dirs tests.

Did not run: Linux GPU tests in entries.rs, which need GB10. The two reparse-attribute mutants survive locally, because this host cannot create a file symlink, so that case runs only on the elevated CI runner and was not tried against a mutant. Item 4's test was not run against the old code. No process ran as SYSTEM or NetworkService, and a real second drive was not exercised.

Closes #2797