On the conditioned generator's bias
Mathematically (and if $60/40$ is the bias of the question's unconditioned source), "the bias in the long run output" can be defined as
$$E(|H(m)|)\;/\;(160-E(|H(m)|))$$
where $E(|H(m)|)$ is the expected value of the Hamming weight of the SHA-1 hash $H(m)$ when $m$ is a 320-bit bitstring made from independent random bits that are 1 with probability $p$, taken to be $p=0.6$ in the question.
A particular $m$ has a probability $p^{|m|}\;(1-p)^{320-|m|}$ . These probabilities sum to $1$, independent of $p$ . We derive
$$E(|H(m)|)\ =\sum_{m\in\{0,1\}^{320}}p^{|m|}\;(1-p)^{320-|m|}\;|H(m)|$$
That is a precisely defined real number (a rational when $p$ is rational), which depends only on the definition of SHA-1, and on $p$.
For $p=0$, $E(|H(m)|=|H(0^{320})|=|_{^{\mathtt{B80DE5D138758541C5F05265AD144AB9FA86D1DB}_h}}|=78$, bias $78/82$;
For $p=1$, $E(|H(m)|=|H(1^{320})|=|_{^{\mathtt{F443319695979917A03B717049235423874D2716}_h}}|=73$, bias $73/87$.
We know no practical way to exactly compute that sum for any other value of $p$ , because there are $2^{320}$ terms all with non-zero $p^{|m|}\;(1-p)^{320-|m|}$, and as far as we know each requires computation of a SHA-1 to get $|H(m)|$ . Except for values of $p$ exceedingly close to $0$ or $1$, we can't even tell if that sum is below or above $80$ (equivalently: if the conditioned output is biased towards 0 or 1); nothing that we know about SHA-1 allows that.
For all practical purposes, the question's conditioned generator is unbiased.
Note: the generator that alternatively outputs $0$ and $1$ also is unbiased. This illustrates that unbiasedness (bias close to 1 per the question's definition) is not a sufficient condition for a generator to be secure. The question's generator is secure and practically indistinguishable from a source of random bits (baring a new break of SHA-1), but the reasoning to conclude that has nothing to do with bias; see below.
On the conditioned generator's security
To conclude that the generator is secure (taken as: not distinguishable from true unbiased independent random bits), we observe that probability for an adversary to guess a 320-bit input are at best $\max(p,1-p)^{320}<2^{-235}$. As an example consequence, there's probability $<2^{-45}$ than any of $2^{100}$ values of $m$ occurs has hash input in $2^{90}$ conditioned hash outputs; and a distinguisher exploiting that remote possibility would need to have computed the $2^{100}$ hashes, or exploit yet unknown weakness of SHA-1 (allowing to deduce something about the input from the output better than by hashing a conjectured input and comparing to the output).
If the hash is unbroken, and fed with blocks of $b$ random secret independent bits each with probability $p$, our security level against any distinguishing attack of the output is, conservatively, at least
$$-\log_2(\max(p,1-p))\cdot b/2 \text{ bit}$$
$-\log_2(\max(p,1-p))$ is the question's min. entropy. Here, for $b=320$ and $p=0.6$, we get about 118-bit security (discounting unknown weakness in SHA-1).
Note: That works for any unbroken hash (or CSPRNG) used to condition a TRNG, including if there is more bits in the output than entropy in the input, as would be the case if we replaced SHA-1 with SHA-512, still hashing 320 biased bits to get 512 conditioned bits. This illustrates the so-called "full entropy" condition is not necessary for security; it's not sufficient either.
Note: If we had $p=0.9$, the question's generator would be practically distinguishable from random: we pre-compute the 160-bit SHA-1 hash of the $2^{20}$ most likely 320-bit inputs, and watch for occurrence of any of these bitstrings in the conditioned generator's output. There's good chance that happens in $2^{40}$ bits, and we'll practically never falsely incriminate a true uniform random source. That's a break of the conditioned generator, with possibly practical consequences. Yet, the bias as per the first part of the answer is still entirely undetectable. This further illustrates unbiasedness is not sufficient for security.
