ISO and VM images still ship the fab bootstrap's machine-id #24

buildtasks#15 empties /etc/machine-id in every bt-layer layer, which covers the tar.zst that keel assemble builds. bt-container, bt-iso and bt-vm build from the ISO and do not pass through bt-layer, so an ISO install or a VM image still carries the bootstrap's id (f0e97605...) unless the installer regenerates it. Check tkl-installer and apply the same reset (empty file, /var/lib/dbus/machine-id symlink) where Keel ships those images. Also from the review: reword the comment at bin/layer-lib:583 (a first boot only enables units), add a test for the child-layer case in tests/layer, and decide whether an empty 0644 file should be reset to 0444.