fix(iso): let empty directories survive the squashfs layer split

bee_layer_classify only ever tracked regular files and symlinks
(`find ... -type f -o -type l`), so any directory that is empty at
build time — like /var/log/nvidia-dcgm, correctly created and chowned
by the datacenter-gpu-manager postinst — was silently dropped from
every layer's rsync --files-from list and never reached the built
ISO. This is why bbc6fb1's 78d1b9b follow-up (seeding a marker file
just for that one path) kept the directory alive: it was a targeted
workaround for a general gap in the classifier, not a fix of it.

Replace that workaround with the general mechanism: classify also
walks every directory, computes the subset that is empty all the way
down (no file or symlink anywhere in its subtree — a directory that
does hold files needs no entry, rsync already recreates it as an
implied parent), and assigns each one to a layer via the same
dpkg-ownership / injected-rule precedence used for files. Add an
injected rule routing /var/log/nvidia-dcgm to 20-nvidia-platform,
alongside the DCGM binaries that actually use it, instead of letting
it fall through to base by default.

bee_layer_build folds each layer's empty-dir list into the same
rsync --files-from call; recursion into a directory that is
by-construction empty copies nothing extra. Revert the 9000/9999 hook
changes from 78d1b9b now that they're redundant, and cover the new
path with test-squashfs-layers.sh (ruled, unruled, and nested-empty
directories, asserted present in the merged rootfs after a real
mksquashfs/unsquashfs round-trip).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

iso/builder/test-squashfs-layers.sh

@@ -98,8 +98,15 @@ mk usr/local/bin/bee-dcgmproftester-staggered "#!stag"
 # unruled file under an nvidia dir stays in base.
 mk usr/share/doc/nvidia-random/README "notes"
 
+# --- empty directories: no file/symlink anywhere in their subtree, so they
+#     never appear in all.files and must be classified/carried separately.
+mkdir -p "$ROOT/var/log/nvidia-dcgm"                 # ruled -> 20-nvidia-platform
+mkdir -p "$ROOT/var/lib/bee-empty-unruled"            # unruled -> base
+mkdir -p "$ROOT/var/lib/bee-empty-nested/still-empty" # nested empty branch -> base
+
 fail() { echo "FAIL: $*" >&2; exit 1; }
 in_layer() { LC_ALL=C grep -qx "$2" "$WD/$1.files" || fail "expected $2 in layer $1"; }
+in_dir_layer() { LC_ALL=C grep -qx "$2" "$WD/$1.dirs" || fail "expected empty dir $2 in layer $1"; }
 
 MONO="$T/filesystem-v14.99.squashfs"
 mksquashfs "$ROOT" "$MONO" -comp zstd -noappend -no-progress -no-xattrs >/dev/null
@@ -146,11 +153,20 @@ in_layer 40-nvidia-dcgm-cuda usr/bin/dcgmproftester12
 in_layer 40-nvidia-dcgm-cuda usr/local/bin/bee-dcgmproftester-staggered
 in_layer 00-base usr/share/doc/nvidia-random/README
 
+in_dir_layer 20-nvidia-platform var/log/nvidia-dcgm
+in_dir_layer 00-base var/lib/bee-empty-unruled
+in_dir_layer 00-base var/lib/bee-empty-nested
+in_dir_layer 00-base var/lib/bee-empty-nested/still-empty
+
 OUT="$T/out"
 bee_layer_build "$R2" "$WD" "$OUT" 14.99 nvidia
 bee_layer_verify_each "$OUT" 14.99 nvidia
 bee_layer_merge "$OUT" 14.99 nvidia "$T/merged"
 
+[ -d "$T/merged/var/log/nvidia-dcgm" ] || fail "empty dir var/log/nvidia-dcgm missing from merged rootfs"
+[ -d "$T/merged/var/lib/bee-empty-unruled" ] || fail "empty dir var/lib/bee-empty-unruled missing from merged rootfs"
+[ -d "$T/merged/var/lib/bee-empty-nested/still-empty" ] || fail "nested empty dir missing from merged rootfs"
+
 MODLIVE="$T/live"; mkdir -p "$MODLIVE"
 cp "$OUT"/filesystem-v14.99-*.squashfs "$MODLIVE/"
 bee_layer_write_module_file "$MODLIVE" 14.99 nvidia