v0.172.0 fixup: EnsureImportRoot must apply the convention to the parent userdata dir

Found on the demo-felhom deploy leg: ensuring only <sysNS>/userdata/import left
its parent at 755 root:root, because EnsureUserdataDir MkdirAll's intermediates
at plain 0755 and chmods only the leaf. That made the system drive's userdata
root the one on the box outside the 2775/gid-1000 convention.

CHANGELOG.md

@@ -75,7 +75,12 @@ picker paths, and the system drive is deliberately not a registered StoragePath.
 `{{if .System}}` would have failed at render for every share. `ShareRow` is now package-level and the
 render test constructs the exact type the handler passes.
 
-Tests 915 → 949, all green. Red-proofs recorded in REPORT.md for Scenario B (classification),
+**Caught during the live deploy leg and fixed in the same version:** `EnsureImportRoot` ensured only
+the leaf, so `MkdirAll`'s intermediates left `<sysNS>/userdata` at `755 root:root` — the one userdata
+root on the box outside the 2775/gid-1000 convention. Both the parent and the import dir now carry it
+(`TestEnsureImportRoot_ParentCarriesTheConvention`).
+
+Tests 915 → 950, all green. Red-proofs recorded in REPORT.md for Scenario B (classification),
 C (determinism) and E (server-side share refusal). No destructive filesystem call was added anywhere
 in this arc. **MinAgent unchanged.**