Colour the host's file rows by what their mode says

The remote pane's NAME column was blue for a directory and plain for everything
else, and the PERMS column was faint whatever it said. Two colours now come off
the mode, split across those two columns on purpose: NAME says what a row is,
so a file with an execute bit is green there, and PERMS says what is notable
about how it is set, so a file anyone may write to is amber over the characters
that actually say so. Because the two never compete for one TextBlock, a
world-writable executable shows both facts instead of one winning an argument.
No new blue is spent, which is what App.axaml asks for: it reserves blue for a
directory, a distinct scope, and calls it deliberately rare.

Both are files only, and each exclusion is a wrong answer avoided rather than a
case not got to. Every symbolic link is lrwxrwxrwx by convention and its mode
governs nothing — what may be written is the target, whose mode an lstat
listing never fetched — so amber there would fire on every link on the host. A
world-writable directory is /tmp, made safe by a sticky bit PosixMode does not
render, and warning about it would be warning about the half of the mode that
is on screen while the half that answers the warning is not. And the execute
bit on a directory means "may be searched", which is true of very nearly every
directory a host has, so green there would paint the whole pane and mark
nothing.

The two questions read back the string PosixMode wrote rather than carrying its
nine booleans through SftpEntry as well. That is the point rather than a
shortcut: two representations of one fact is how a row ends up coloured for a
bit the column beside it does not show. A mode of the wrong length answers
false rather than throwing, since these decide a colour and a listing is not
worth failing over one.

The amber is Warn rather than WarnText, which is the muted amber a warning card
writes its sentences in. At 9.5px against TextFaint that one is a shade rather
than a signal, and a marker nobody notices is the same as no marker.

The local pane is untouched, on the grounds it already gives for having no
PERMS column at all: a POSIX mode is not a fact about a file on Windows, and
colouring one there would invent exactly what the column declines to print.

Twenty cases in RemotePathTests, which needs no container — the execute bit in
any of the three triples rather than only the owner's, the others-write bit
alone, a mode of the wrong length, and the file-only rule for both questions
from all three kinds. dotnet format is clean and the app and layout suites pass
at 109 and 35.

src/DodoSSH.Client.Ssh/SftpSession.cs

@@ -51,6 +51,32 @@ public sealed record SftpEntry(
     /// file fails the listing instead, which is the caller's cue that it was not a directory after all.
     /// </remarks>
     public bool IsNavigable => Kind is SftpEntryKind.Directory or SftpEntryKind.SymbolicLink;
+
+    /// <summary>Whether this is a file somebody can run.</summary>
+    /// <remarks>
+    /// Files only. On a directory the execute bit means "may be searched", which is true of very nearly every
+    /// directory on a host — a listing that marked them all would be marking nothing.
+    /// </remarks>
+    public bool IsExecutable => Kind is SftpEntryKind.File && PosixMode.HasAnyExecuteBit(Permissions);
+
+    /// <summary>
+    /// Whether this is a file any account on the host may write to.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// Files only, and for two separate reasons. A symbolic link is <c>lrwxrwxrwx</c> by convention on every
+    /// system that has one, and its mode governs nothing: what may be written is the target, whose own mode
+    /// this listing did not fetch. And a directory that everyone may write to is the ordinary arrangement for
+    /// <c>/tmp</c>, made safe by the sticky bit — which <see cref="PosixMode"/> does not render, so flagging
+    /// the directory would be warning about the half of the mode that is on screen while the half that
+    /// answers the warning is not.
+    /// </para>
+    /// <para>
+    /// It is not a claim that writing is dangerous, only that the mode says something a reader of that column
+    /// would want to have noticed.
+    /// </para>
+    /// </remarks>
+    public bool IsWorldWritable => Kind is SftpEntryKind.File && PosixMode.IsWorldWritable(Permissions);
 }
 
 /// <summary>
@@ -106,6 +132,27 @@ public static class PosixMode
             triple[2] = execute ? 'x' : '-';
         }
     }
+
+    /// <summary>Whether any of the three execute bits is set.</summary>
+    public static bool HasAnyExecuteBit(string mode) =>
+        At(mode, OwnerExecute) == 'x' || At(mode, GroupExecute) == 'x' || At(mode, OthersExecute) == 'x';
+
+    /// <summary>Whether the others triple carries the write bit.</summary>
+    public static bool IsWorldWritable(string mode) => At(mode, OthersWrite) == 'w';
+
+    private const int OwnerExecute = 3;
+    private const int GroupExecute = 6;
+    private const int OthersWrite = 8;
+    private const int OthersExecute = 9;
+
+    /// <remarks>
+    /// Reading back what <see cref="Format"/> wrote, rather than carrying the nine booleans through
+    /// <see cref="SftpEntry"/> as well. The alternative is a second representation of one fact, and the two
+    /// disagreeing is the failure this avoids — a row coloured for a bit the column beside it does not show.
+    /// Anything that is not a mode this type wrote answers false rather than throwing: these questions decide
+    /// a colour, and a listing is not worth failing over one.
+    /// </remarks>
+    private static char At(string mode, int index) => mode.Length == 10 ? mode[index] : '-';
 }
 
 /// <summary>