[Backport 7.83.x] Run system-probe config fixups after BuildSchema (#54752)

Backport d019929 from #54738.

 ___

### What does this PR do?

Renames `fixupInitSystemProbe` to `postProcessSystemProbe` and moves the call from `fixupInitConfig` into `LoadDatadog`, right after `useHostEtc`.

### Motivation

`postProcessSystemProbe` reads and writes system-probe config keys (`apt_config_dir`, `yum_repos_dir`, `zypper_repos_dir`) to rewrite them under `HOST_ETC`. It was being called too early on two counts:

- Before `BuildSchema()` marks the config ready, so the readiness guard in the getters kicks in and `GetSource`/`GetString` silently no-op. Agents logged `attempt to read key before config is constructed: system_probe_config.apt_config_dir` (and the yum/zypper equivalents) on every start, and the rewrite never applied since `GetSource` returns `SourceUnknown` instead of `SourceDefault` while the config isn't ready.
- Before `useHostEtc` runs, so even once that readiness issue is fixed, auto-detected `HOST_ETC` (as opposed to one set in the env ahead of time) still wouldn't be picked up.

This was introduced in #53983, which changed the function from a no-op into a real implementation without accounting for either ordering constraint.

### Describe how you validated your changes

Added a regression test (`TestPostProcessSystemProbeRunsAfterConfigIsReady`) that runs the real `InitConfigObjects()` + `LoadDatadog()` flow with `HOST_ETC` set and asserts the three keys get rewritten. Confirmed it fails against the old code (reproducing the exact error messages seen in the field) and passes with the fix. Also ran the full `pkg/config/setup` test suite and linter, no regressions.

### Additional Notes

Serverless builds don't call this at all, since they have no system-probe config.

Co-authored-by: sabrina.lu <sabrina.lu@datadoghq.com>

Author: dd-octo-sts[bot]

pkg/config/setup/BUILD.bazel

@@ -61,6 +61,7 @@ go_library(
 dd_agent_go_test(
     name = "setup_test",
     srcs = [
+        "config_init_test.go",
         "config_secret_test.go",
         "config_test.go",
         "privateactionrunner_test.go",

pkg/config/setup/config.go

@@ -523,6 +523,8 @@ func LoadDatadog(config pkgconfigmodel.Config, secretResolver secrets.Component,
 
 	useHostEtc(config)
 
+	postProcessSystemProbe(SystemProbe())
+
 	err = checkConflictingOptions(config)
 	if err != nil {
 		return err

pkg/config/setup/config_init.go

@@ -19,7 +19,4 @@ func fixupInitConfig() {
 	ddcfg := Datadog()
 	fixupInitCommonConfigComponents(ddcfg)
 	fixupInitFullAgentOnlyComponents(ddcfg)
-
-	sysprobe := SystemProbe()
-	fixupInitSystemProbe(sysprobe)
 }

pkg/config/setup/config_init_test.go

@@ -0,0 +1,52 @@
+// Unless explicitly stated otherwise all files in this repository are licensed
+// under the Apache License Version 2.0.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2016-present Datadog, Inc.
+
+//go:build test && !serverless
+
+package setup
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	delegatedauthmock "github.com/DataDog/datadog-agent/comp/core/delegatedauth/mock"
+	secretsmock "github.com/DataDog/datadog-agent/comp/core/secrets/mock"
+	pkgconfigmodel "github.com/DataDog/datadog-agent/pkg/config/model"
+)
+
+// Regression test: the HOST_ETC repo dir rewrite used to run before the config was ready
+// (and before HOST_ETC auto-detection), so it silently never applied.
+func TestPostProcessSystemProbeRunsAfterConfigIsReady(t *testing.T) {
+	origDatadog := Datadog().(pkgconfigmodel.BuildableConfig)
+	origSystemProbe := SystemProbe().(pkgconfigmodel.BuildableConfig)
+	t.Cleanup(func() {
+		SetDatadog(origDatadog)         // nolint: forbidigo // restoring the singleton after the test
+		SetSystemProbe(origSystemProbe) // nolint: forbidigo // restoring the singleton after the test
+	})
+
+	InitConfigObjects()
+
+	t.Setenv("HOST_ETC", "/host/etc")
+
+	configPath := filepath.Join(t.TempDir(), "empty_conf.yaml")
+	require.NoError(t, os.WriteFile(configPath, nil, 0o600))
+	Datadog().(pkgconfigmodel.BuildableConfig).SetConfigFile(configPath)
+
+	err := LoadDatadog(Datadog(), secretsmock.New(t), delegatedauthmock.New(t), nil)
+	require.NoError(t, err)
+
+	for _, name := range []string{
+		"system_probe_config.apt_config_dir",
+		"system_probe_config.yum_repos_dir",
+		"system_probe_config.zypper_repos_dir",
+	} {
+		val := SystemProbe().GetString(name)
+		require.True(t, strings.HasPrefix(val, "/host/etc"), "expected %s to be rooted under HOST_ETC, got %q", name, val)
+	}
+}

pkg/config/setup/fixup_init.go

@@ -117,8 +117,9 @@ func fixupInitFullAgentOnlyComponents(_ pkgconfigmodel.Config) {
 	pkgconfigmodel.AddOverrideFunc(sanitizeExternalMetricsProviderChunkSize)
 }
 
-// called only for system-probe, after declaring settings
-func fixupInitSystemProbe(config pkgconfigmodel.Config) {
+// postProcessSystemProbe rewrites system-probe repo dir defaults to live under HOST_ETC.
+// Called from LoadDatadog, after the config is ready and HOST_ETC has been determined.
+func postProcessSystemProbe(config pkgconfigmodel.Config) {
 	if value, _ := os.LookupEnv("HOST_ETC"); value != "" {
 		for _, name := range []string{
 			"system_probe_config.apt_config_dir",