Update stale /sbin/ references to real FHS paths

The reorg moved user binaries under /system (init -> /system/services/init,
drivers -> /system/drivers/<name>, vfs-test -> /system/services/vfs/vfs-test), but
many comments and log strings still named the old /sbin/ home. Retarget them all:
kernel/loader/test comments and the two boot log lines, plus vision.md and the
driver-model.md proposed tree (also dropped the stale `d` suffixes and rt->runtime
there). The initial-ramdisk spawn log no longer fakes a /sbin/ prefix, since those
binaries live in different homes (services vs drivers).

Left the FSH design doc's /sbin and /lib rows alone — whether /sbin stays a
directory at all is a design call for its owner, not a stale-comment fix.

test/qemu_test.py

@@ -169,12 +169,12 @@ CASES = [
     {"name": "user-pf",
      "expect": r"page fault \(vector 14\)[\s\S]*error code : 0x5[\s\S]*IP\s*: 0x00007000000000",
      "fail":   r"DANOS-TEST-RESULT: FAIL"},
-    # The real user binary: the bootloader ships sbin/init off the ESP, the
+    # The real user binary: the bootloader ships /system/services/init off the ESP, the
     # kernel loads the ELF and runs it in ring 3, and it writes + exits cleanly.
     {"name": "init",
      "expect": r"DANOS-TEST-RESULT: PASS",
      "fail":   r"DANOS-TEST-RESULT: FAIL"},
-    # Real processes: /sbin/init loaded as a scheduled ring-3 process with its
+    # Real processes: /system/services/init loaded as a scheduled ring-3 process with its
     # own address space, run twice (create/exit/teardown/recreate), coexisting
     # with a kernel task under preemption.
     {"name": "process",