v0.172.0 fixup: EnsureImportRoot must apply the convention to the parent userdata dir

Found on the demo-felhom deploy leg: ensuring only <sysNS>/userdata/import left
its parent at 755 root:root, because EnsureUserdataDir MkdirAll's intermediates
at plain 0755 and chmods only the leaf. That made the system drive's userdata
root the one on the box outside the 2775/gid-1000 convention.

controller/internal/stacks/import_root_classify_test.go

@@ -323,3 +323,26 @@ func TestPathUnderIsSegmentWise(t *testing.T) {
 		t.Error("a name-prefix sibling must NOT be under the root")
 	}
 }
+
+// EnsureImportRoot must apply the convention to the import dir AND its parent userdata dir.
+// Observed live on demo-felhom (v0.172.0 first cut): ensuring only the leaf left
+// <sysNS>/userdata at 755 root:root, the one userdata root on the box outside the convention.
+func TestEnsureImportRoot_ParentCarriesTheConvention(t *testing.T) {
+	m := newMigManager(t, "")
+	m.cfg.Paths.SystemDataPath = t.TempDir() // writable stand-in for /mnt/sys_drive
+
+	if err := m.EnsureImportRoot(); err != nil {
+		// chown to gid 1000 fails for a non-root test user; the modes still land.
+		t.Logf("EnsureImportRoot returned %v (expected off-root)", err)
+	}
+	sysNS := appbackup.NamespaceRoot(m.cfg.Paths.SystemDataPath, false)
+	for _, p := range []string{appbackup.UserdataDir(sysNS), appbackup.ImportDir(sysNS)} {
+		fi, err := os.Stat(p)
+		if err != nil {
+			t.Fatalf("%s not created: %v", p, err)
+		}
+		if fi.Mode().Perm() != 0o775 || fi.Mode()&os.ModeSetgid == 0 {
+			t.Errorf("%s mode = %v, want setgid + 0775 (2775)", p, fi.Mode())
+		}
+	}
+}