Land WriteBundle should rmdir a stale directory at the bind-mount target

When landconfigregistry adds a new container to a role bundle, the bind-mount source on each land (e.g. `/opt/nimsforeststripe/config.yaml`) doesn't exist yet. Docker then creates an empty **directory** at that path the first time the container starts. On the next reconcile, Land's `WriteBundle` (`land/pkg/land/configpull.go`) calls `fileMatches(path, content)` which does `os.ReadFile(path)` and bails with `is a directory` — so the file is never written and the service stays broken in a loop.

Hit this today bringing up stripe on four org lands; required a manual `rmdir /opt/nimsforeststripe/config.yaml` per land before reconcile could place the rendered config.

**Fix:** before writing, `os.Stat(path)`. If it's a directory, attempt `os.Remove` (will succeed if empty, which is the typical case here since docker only creates an empty dir). If non-empty, log a clear error so the operator knows what to investigate. Then proceed with the write.

**Affected files:**
- `land/pkg/land/configpull.go` — `WriteBundle` and the `fileMatches` helper.

**Verification:** on a clean land, add a new service to its role bundle, reconcile, verify the config file appears at the expected path. Without the fix today this requires manual rmdir intervention.