Handle empty code objects consistently across workloads
Dockerfile and registry services can reuse the canonical empty object registered by a VM, which has no uploaded archive. The worker only handled that object locally for sandboxes and VMs, so services failed during mount setup with S3 NoSuchKey.
Use the existing empty-workspace path whenever the object has the canonical empty hash. This is a one-line runtime change; missing nonempty objects still fail.
Validation: the expanded regression test fails for services before the fix and passes afterward. Mount/cache tests and abstraction common tests pass. The full worker suite has one unrelated macOS failure in TestCheckpointHostProfileIgnoresWorkerRelease, which expects a Linux CPU profile.
Summary by cubic
Fixes services that reference the canonical empty code object from failing during mount setup with S3 NoSuchKey. The worker previously applied the local empty-workspace path only to sandboxes and VMs, even though Dockerfile, registry, and other workloads share the same empty object, which has no uploaded archive.
- The empty-object check now runs for all stub types; missing nonempty objects still fail as before.
- Regression tests cover every stub type and verify the missing-object failure path.