internal/pkg: fail on empty output directory

This works around the fact that execArtifact always creates the work directory when setting up the bind mount.

Signed-off-by: Ophestra <cat@gensokyo.uk>

internal/pkg/exec.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"runtime"
 	"slices"
+	"syscall"
 
 	"hakurei.app/container"
 	"hakurei.app/container/check"
@@ -286,8 +287,9 @@ func (a *execArtifact) cure(c *CureContext, hostNet bool) (err error) {
 		}
 		z.Bind(b[0], b[1], 0)
 	}
+	work := c.GetWorkDir()
 	z.Bind(
-		c.GetWorkDir(),
+		work,
 		fhs.AbsRoot.Append("work"),
 		std.BindWritable|std.BindEnsure,
 	)
@@ -322,5 +324,19 @@ func (a *execArtifact) cure(c *CureContext, hostNet bool) (err error) {
 	if err = z.Serve(); err != nil {
 		return
 	}
-	return z.Wait()
+	if err = z.Wait(); err != nil {
+		return
+	}
+
+	// do not allow empty directories to succeed
+	for {
+		err = syscall.Rmdir(work.String())
+		if err != syscall.EINTR {
+			break
+		}
+	}
+	if err != nil && errors.Is(err, syscall.ENOTEMPTY) {
+		err = nil
+	}
+	return
 }