v0.172.0 fixup: EnsureImportRoot must apply the convention to the parent userdata dir

Found on the demo-felhom deploy leg: ensuring only <sysNS>/userdata/import left
its parent at 755 root:root, because EnsureUserdataDir MkdirAll's intermediates
at plain 0755 and chmods only the leaf. That made the system drive's userdata
root the one on the box outside the 2775/gid-1000 convention.

controller/internal/stacks/skeleton_derive.go

@@ -77,5 +77,16 @@ func (m *Manager) EnsureImportRoot() error {
 	if root == "" {
 		return nil
 	}
+	// The PARENT userdata dir must carry the convention too. EnsureUserdataDir MkdirAll's its
+	// intermediates at plain 0755 and then chmods only the leaf, so ensuring just the import dir
+	// leaves <sysNS>/userdata at 755 root:root — the one userdata root on the box that would not
+	// be 2775/gid-1000. Observed live on demo-felhom before this line existed.
+	sys := m.cfg.Paths.SystemDataPath
+	if sys == "" {
+		return nil
+	}
+	if err := appbackup.EnsureUserdataDir(appbackup.UserdataDir(appbackup.NamespaceRoot(sys, false))); err != nil {
+		return err
+	}
 	return appbackup.EnsureUserdataDir(root)
 }