fix(tools): defer var/run creation until after pivot

[ethe]

Fixes #202

Summary

• stop traversing /mnt/user/var/run before pivot_root
• keep the real /mnt/user/run preparation and let pivot-init create /var/run after the root switch
• add a regression check to make test-unit and cover both init scripts in the CI path filters

Why

Some distribution images, including Ubuntu, provide /var/run as an absolute symlink to /run. Before pivot_root, following that symlink resolves against the tools-drive root instead of the mounted user root and produces the deterministic bootstrap warning reported in #202.

pivot-init already creates and mounts /run, then prepares /var/run after the root switch. Deferring this redundant directory preparation therefore fixes absolute-symlink resolution without distro detection or image-specific behavior.

Validation

• bash scripts/tests/verify-tools-init.sh
• shellcheck tools-image/init tools-image/pivot-init scripts/tests/verify-tools-init.sh
• actionlint .github/workflows/ci.yml
• git diff --check

Release note

This updates the tools-image source. After merge, a new immutable ghcr.io/kvcache-ai/agentenv-tools version still needs to be published and selected in config/deps_manifest.toml; the existing 0.1.0 artifact will not contain the change.

[github-actions]

✅ OpenCodeReview: Review complete: 0 finding(s) across 4 selected item(s).