Render kea unix socket paths under /var/run/kea

Kea 2.6.5 restricts control/HA unix socket paths to its compiled
runstatedir and rejects any other path by exact string match
("invalid path specified: '/run/kea', supported path is '/var/run/kea'"),
even though /var/run is a symlink to /run. The operator rendered sockets
under /run/kea, so kea-dhcp4 and kea-ctrl-agent crash-looped on startup.

- Point RunDir at /var/run/kea so all derived config/socket paths match.
- Pre-create /var/run/kea in the kea image.
- Assert rendered socket paths live under /var/run/kea.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

internal/kea/consts.go

@@ -10,8 +10,11 @@ const (
 
 	// ConfigDir is where projected config is mounted read-only.
 	ConfigDir = "/etc/kea-operator"
-	// RunDir is a shared emptyDir for the config copy and control socket.
-	RunDir = "/run/kea"
+	// RunDir is a shared emptyDir for the config copy and control socket. Kea
+	// 2.6+ restricts unix socket paths to its compiled runstatedir and rejects
+	// anything else by exact string ("supported path is '/var/run/kea'"), even
+	// though /var/run symlinks to /run, so this must be the literal /var/run/kea.
+	RunDir = "/var/run/kea"
 
 	// DHCP4ConfPath is the runtime kea-dhcp4 config.
 	DHCP4ConfPath = RunDir + "/kea-dhcp4.conf"