Update stale /sbin/ references to real FHS paths

The reorg moved user binaries under /system (init -> /system/services/init,
drivers -> /system/drivers/<name>, vfs-test -> /system/services/vfs/vfs-test), but
many comments and log strings still named the old /sbin/ home. Retarget them all:
kernel/loader/test comments and the two boot log lines, plus vision.md and the
driver-model.md proposed tree (also dropped the stale `d` suffixes and rt->runtime
there). The initial-ramdisk spawn log no longer fakes a /sbin/ prefix, since those
binaries live in different homes (services vs drivers).

Left the FSH design doc's /sbin and /lib rows alone — whether /sbin stays a
directory at all is a design call for its owner, not a stale-comment fix.

system/kernel/process.zig

@@ -3,7 +3,7 @@
 //! loader; in-kernel code is linked into the kernel image, not loaded here.
 //!
 //! Two entry points:
-//! - `spawnProcess` loads a user ELF (`/sbin/init`, and later servers/drivers)
+//! - `spawnProcess` loads a user ELF (`/system/services/init`, and later servers/drivers)
 //!   into a fresh address space and schedules it as a real preemptive ring-3
 //!   process on its own page tables. This is the production path.
 //! - `run` executes a raw code blob (the user-pf isolation test program) on the
@@ -448,7 +448,7 @@ pub fn run(blob: []const u8) RunError!void {
     pmm.free(stack_frame);
 }
 
-// --- user ELF loading (/sbin/init) ------------------------------------------
+// --- user ELF loading (/system/services/init) ------------------------------------------
 
 pub const InitError = error{
     BadElf, // malformed/inapplicable image (magic, class, machine, type, bounds)