Update stale /sbin/ references to real FHS paths

The reorg moved user binaries under /system (init -> /system/services/init,
drivers -> /system/drivers/<name>, vfs-test -> /system/services/vfs/vfs-test), but
many comments and log strings still named the old /sbin/ home. Retarget them all:
kernel/loader/test comments and the two boot log lines, plus vision.md and the
driver-model.md proposed tree (also dropped the stale `d` suffixes and rt->runtime
there). The initial-ramdisk spawn log no longer fakes a /sbin/ prefix, since those
binaries live in different homes (services vs drivers).

Left the FSH design doc's /sbin and /lib rows alone — whether /sbin stays a
directory at all is a design call for its owner, not a stale-comment fix.

docs/vision.md

@@ -84,13 +84,13 @@ interrupts](interrupts.md), a [calibrated timer + ns clock](device-interrupts.md
 in-kernel [IPC channels](ipc.md), SMP (all cores scheduling, with affinity), a
 **higher-half kernel** with a physmap, and **user space**: per-process address
 spaces, `syscall`/`sysret` with the `swapgs` discipline, a user-ELF loader, and
-`/sbin/init` — a real user ELF built from `sbin/`, running at CPL 3 as PID 1 on its
+`/system/services/init` — a real user ELF built from `system/services/init/`, running at CPL 3 as PID 1 on its
 own page tables — plus a [test harness](testing.md).
 
 - **Isolation track** — **user mode + address-space isolation**. *Done: a
   higher-half kernel with a physmap (the low half is user space), per-process
   address spaces with CR3 switched on context switch, the `swapgs` discipline,
-  `syscall`/`sysret`, a user-ELF loader, and `/sbin/init` running as a real
+  `syscall`/`sysret`, a user-ELF loader, and `/system/services/init` running as a real
   preemptive ring-3 process (PID 1). Remaining polish: an address-space/stack
   reaper for exited tasks, SMAP + fault-recovering copy-in/out, the real IPC
   syscalls (IPC_Call/IPC_ReplyWait — they arrive with the second user server),