fix(iso): seed a real file in /var/log/nvidia-dcgm so it survives squashfs layering

bbc6fb1 chowned the directory correctly but it stayed empty at build
time, and bee_layer_classify (squashfs-layers.sh) only tracks regular
files and symlinks via `find ... -type f -o -type l` — an empty
directory is silently dropped from every layer's rsync --files-from
list and never reaches the built ISO. dcgmi diag's deployment check
still failed with DCGM_FR_FILE_CREATE_PERMISSIONS after rebuilding on
top of that fix because the directory simply didn't exist at boot.

Seed /var/log/nvidia-dcgm/.keep so the directory rides along the
classifier as an implied parent (rsync -a preserves its ownership),
and stop 9999-slim's log sweep from deleting that marker before the
classifier ever sees it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

iso/builder/config/hooks/normal/9000-bee-setup.hook.chroot

@@ -50,12 +50,20 @@ if [ "$GPU_VENDOR" = "nvidia" ]; then
     # nvidia-dcgm.service runs `nv-hostengine --service-account nvidia-dcgm`,
     # which drops privileges to that account for all file I/O and writes
     # diagnostics to DCGM_HOME_DIR (/var/log/nvidia-dcgm, per the packaged
-    # unit's Environment=). The package postinst doesn't reliably create/own
+    # unit's Environment=). The package's own postinst already creates and
-    # this directory inside a live-build chroot, so `dcgmi diag`'s deployment
+    # chowns this directory correctly — but it's empty at that point, and
-    # check fails with DCGM_FR_FILE_CREATE_PERMISSIONS at boot. Own it here
+    # lib/squashfs-layers.sh's classifier only tracks regular files and
-    # to match nv-hostengine's actual runtime identity.
+    # symlinks (`find ... -type f -o -type l`), so an empty directory is
+    # silently dropped from every layer's rsync --files-from list and never
+    # reaches the built ISO at all. `dcgmi diag`'s deployment check then
+    # fails with DCGM_FR_FILE_CREATE_PERMISSIONS at boot because the
+    # directory doesn't exist, regardless of ownership. Re-create it and
+    # seed one real file so it rides along the classifier and rsync -a
+    # recreates the parent directory (with this ownership) as an implied
+    # parent.
     if id nvidia-dcgm >/dev/null 2>&1; then
         install -d -o nvidia-dcgm -g nvidia-dcgm -m 0755 /var/log/nvidia-dcgm
+        install -o nvidia-dcgm -g nvidia-dcgm -m 0644 /dev/null /var/log/nvidia-dcgm/.keep
     fi
 elif [ "$GPU_VENDOR" = "amd" ]; then
     # ROCm symlinks (packages install to /opt/rocm-*/bin/)

iso/builder/config/hooks/normal/9999-slim.hook.chroot

@@ -27,6 +27,9 @@ rm -rf /var/lib/apt/lists/*
 
 # ── Misc ──────────────────────────────────────────────────────────────────────
 rm -rf /tmp/* /var/tmp/* 2>/dev/null || true
-find /var/log -type f -delete 2>/dev/null || true
+# /var/log/nvidia-dcgm/.keep is intentionally seeded by 9000-bee-setup so an
+# otherwise-empty DCGM_HOME_DIR survives the squashfs layer classifier (which
+# only tracks files/symlinks, not empty directories) — never sweep it up here.
+find /var/log -type f ! -path '/var/log/nvidia-dcgm/.keep' -delete 2>/dev/null || true
 
 echo "=== slim: done ==="