Update stale /sbin/ references to real FHS paths

The reorg moved user binaries under /system (init -> /system/services/init,
drivers -> /system/drivers/<name>, vfs-test -> /system/services/vfs/vfs-test), but
many comments and log strings still named the old /sbin/ home. Retarget them all:
kernel/loader/test comments and the two boot log lines, plus vision.md and the
driver-model.md proposed tree (also dropped the stale `d` suffixes and rt->runtime
there). The initial-ramdisk spawn log no longer fakes a /sbin/ prefix, since those
binaries live in different homes (services vs drivers).

Left the FSH design doc's /sbin and /lib rows alone — whether /sbin stays a
directory at all is a design call for its owner, not a stale-comment fix.

system/kernel/kernel.zig

@@ -272,18 +272,18 @@ fn kmain(boot_information: *const BootInformation) noreturn {
     log.checkpoint(cp_running);
     status("kernel initialised.\n");
 
-    // Hand over to user space: load /sbin/init (read off the boot volume by the
+    // Hand over to user space: load /system/services/init (read off the boot volume by the
     // loader) and spawn it as a real ring-3 process, PID 1. It runs on its own
     // address space, preemptively, alongside the kernel — no cooperative
     // borrowing. This boot context then becomes the BSP's idle loop.
     if (boot_information.init_len != 0) {
-        status("starting /sbin/init...\n");
+        status("starting /system/services/init...\n");
         const image = @as([*]const u8, @ptrFromInt(boot_handoff.physicalToVirtual(boot_information.init_base)))[0..boot_information.init_len];
         process.spawnProcess(image, 4) catch |err| {
-            statusPrint("/sbin/init failed to load: {s}\n", .{@errorName(err)});
+            statusPrint("/system/services/init failed to load: {s}\n", .{@errorName(err)});
         };
     } else {
-        status("no /sbin/init on the boot volume.\n");
+        status("no /system/services/init on the boot volume.\n");
     }
 
     // Spawn the extra user binaries the loader ferried in the initial_ramdisk (the VFS
@@ -294,7 +294,7 @@ fn kmain(boot_information: *const BootInformation) noreturn {
     // Become the idle task: drop below every real task and halt until an
     // interrupt. The timer keeps preempting into init and any other work.
     scheduler.setPriority(0);
-    status("\nkernel idle; /sbin/init is running.\n");
+    status("\nkernel idle; /system/services/init is running.\n");
     architecture.halt();
 }
 
@@ -311,7 +311,7 @@ fn startInitialRamdiskBinaries(boot_information: *const boot_handoff.BootInforma
     var i: u32 = 0;
     while (i < rd.count) : (i += 1) {
         const item = rd.entry(i) orelse continue;
-        statusPrint("starting /sbin/{s} (from initial_ramdisk)...\n", .{item.name});
+        statusPrint("starting {s} (from initial-ramdisk)...\n", .{item.name});
         process.spawnProcess(item.blob, 4) catch |err| {
             statusPrint("initial_ramdisk: {s} failed to load: {s}\n", .{ item.name, @errorName(err) });
         };

system/kernel/process.zig

@@ -3,7 +3,7 @@
 //! loader; in-kernel code is linked into the kernel image, not loaded here.
 //!
 //! Two entry points:
-//! - `spawnProcess` loads a user ELF (`/sbin/init`, and later servers/drivers)
+//! - `spawnProcess` loads a user ELF (`/system/services/init`, and later servers/drivers)
 //!   into a fresh address space and schedules it as a real preemptive ring-3
 //!   process on its own page tables. This is the production path.
 //! - `run` executes a raw code blob (the user-pf isolation test program) on the
@@ -448,7 +448,7 @@ pub fn run(blob: []const u8) RunError!void {
     pmm.free(stack_frame);
 }
 
-// --- user ELF loading (/sbin/init) ------------------------------------------
+// --- user ELF loading (/system/services/init) ------------------------------------------
 
 pub const InitError = error{
     BadElf, // malformed/inapplicable image (magic, class, machine, type, bounds)

system/kernel/tests.zig

@@ -868,7 +868,7 @@ fn procWorker() void {
     scheduler.exit();
 }
 
-/// Real processes: load /sbin/init as TWO scheduled ring-3 processes, each with
+/// Real processes: load /system/services/init as TWO scheduled ring-3 processes, each with
 /// its own address space at the same virtual addresses, running concurrently
 /// with a kernel task. Both must make heartbeat syscalls from CPL 3 — which can
 /// only happen if each runs on its own page tables (CR3 switched correctly per
@@ -876,7 +876,7 @@ fn procWorker() void {
 /// strongest cheap proof of address-space isolation.
 fn processTest(boot_information: *const BootInformation) void {
     log("DANOS-TEST-BEGIN: process\n", .{});
-    check("bootloader handed over sbin/init", boot_information.init_len != 0);
+    check("bootloader handed over /system/services/init", boot_information.init_len != 0);
     if (boot_information.init_len == 0) {
         result();
         return;
@@ -920,14 +920,14 @@ fn userPfTest() void {
     log("DANOS-TEST-RESULT: FAIL (user read of kernel memory did not fault)\n", .{});
 }
 
-/// The full PID-1 path: the bootloader read sbin/init off the boot volume and
+/// The full PID-1 path: the bootloader read /system/services/init off the boot volume and
 /// handed it over; load it as a user ELF and spawn it as a real ring-3 process
 /// — the same call the normal boot path makes — then confirm it beats. init
 /// heartbeats forever, so this proves it reaches ring 3, makes repeated syscalls
 /// (write + sleep), and stays alive rather than exiting.
 fn initTest(boot_information: *const BootInformation) void {
     log("DANOS-TEST-BEGIN: init\n", .{});
-    check("bootloader handed over sbin/init", boot_information.init_len != 0);
+    check("bootloader handed over /system/services/init", boot_information.init_len != 0);
     if (boot_information.init_len == 0) {
         result();
         return;