fix(agent): drop baked dbus machine-id so regen yields a fresh id

[CMGS]

The bug

Found during cocoon clone-reseed e2e: cocoon vm reseed --machine-id (and clone auto-reseed) reported success and /etc/machine-id's mtime changed, but the content was the same id. regenMachineID truncates /etc/machine-id, then systemd-machine-id-setup runs — and its documented source order falls back to /var/lib/dbus/machine-id. Images that bake that as a regular file (not a symlink to /etc/machine-id) make setup re-adopt the stale id. Result: clones keep the source's machine-id, defeating the whole point of regen.

The CRNG entropy/reseed ioctls — the security-critical mechanism — were never affected; this is only the machine-id half.

Fix

Before running systemd-machine-id-setup, remove /var/lib/dbus/machine-id iff it's a regular file (Lstat + Mode().IsRegular() — a symlink into /etc/machine-id is correct and left untouched). setup then has no stale source to fall back to and generates a fresh id; dbus recreates its copy from the new /etc/machine-id on next start.

Verification

lint 0 issues × {linux,darwin,windows}, tests green. End-to-end machine-id-actually-rotates verification lands when this ships as v0.1.7 and gets baked into an os-image (chicken-and-egg with the guest agent version); the root cause is precisely the systemd source-order fallback, which this removes.

[CMGS]

Hardened per review (thanks — the original swallowed non-ErrNotExist Lstat errors via err == nil, inconsistent with this file's own os.Remove(systemdRandomSeed) idiom two lines up, and wrong for a uniqueness-critical op):

• Extracted dropStaleDBusMachineID(path): ignores fs.ErrNotExist, surfaces any other lstat error (regen fails loudly rather than proceeding to re-adopt the old id), removes only a regular file, leaves a symlink/other untouched.
• Unit test TestDropStaleDBusMachineID (linux-tagged): regular-file-removed / symlink-preserved / missing-no-op.
• Test executed on real linux (cross-compiled test binary run on the bare-metal testbed) — all 3 subtests + full agent package PASS. (The file is //go:build linux; a darwin go test silently skips it — verified it actually runs.)
• make lint 0×3 GOOS (the linux file is covered by the GOOS=linux lint pass).

[CMGS]

Ran the full /code + /simplify + tighten pass (was skipped before — thanks for catching):

• senior /code walk (self, top-to-bottom vs SKILL.md): const grouping, func placement (regen → helper → fallback in call order), error-wrap style, naming, modern-stdlib — all conform.
• /simplify (three lenses, done inline given the ~20-line surface rather than spawning agents): reuse — no repo helper reimplemented; simplification — aligned the lstat error handling to the nested if err != nil { if ErrNotExist… } form used by the sibling os.Stat(machineIDPath) 5 lines up (was a flat errors.Is-first branch); efficiency — one lstat + conditional remove, nothing wasted.
• tighten: godoc 4→3 lines (dropped the duplicated "old id"); test os.IsNotExist → errors.Is(err, fs.ErrNotExist) (soft-deprecated form modernized).
• Re-verified after the edits: lint 0×3 GOOS, and the linux test binary re-run on the bare-metal testbed — 3 subtests + full agent package PASS.