Render kea unix socket paths under /var/run/kea

Kea 2.6.5 restricts control/HA unix socket paths to its compiled
runstatedir and rejects any other path by exact string match
("invalid path specified: '/run/kea', supported path is '/var/run/kea'"),
even though /var/run is a symlink to /run. The operator rendered sockets
under /run/kea, so kea-dhcp4 and kea-ctrl-agent crash-looped on startup.

- Point RunDir at /var/run/kea so all derived config/socket paths match.
- Pre-create /var/run/kea in the kea image.
- Assert rendered socket paths live under /var/run/kea.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

Dockerfile.kea

@@ -13,7 +13,7 @@ RUN dnf -y install epel-release \
  && dnf -y install kea kea-hooks \
  && dnf clean all \
  && rm -rf /var/cache/dnf \
- && mkdir -p /run/kea
+ && mkdir -p /var/run/kea
 
 EXPOSE 67/udp 8000/tcp
 # Command is supplied by the operator (per-container entrypoint scripts).