Add tini as PID 1, guest clock sync, and fix PATH in guest VMs

- Use tini as PID 1 in wrenn-init.sh so zombie processes are reaped
  and signals are forwarded correctly to envd
- Set standard PATH in wrenn-init.sh so child processes spawned by envd
  can find common binaries (fixes "nice: ls command not found")
- Add envdclient.Init() to POST /init on envd after every boot/resume,
  syncing the guest clock via unix.ClockSettime — critical after snapshot
  resume where the guest clock is frozen
- Run Init in a background goroutine so it doesn't block the CreateSandbox
  RPC response; a slow Init (vCPU busy with envd startup) was causing the
  RPC context to be canceled before the response reached the control plane
- Update rootfs-from-container.sh and update-debug-rootfs.sh to inject
  tini into the rootfs, checking the container image and host first,
  downloading from GitHub releases as fallback

scripts/update-debug-rootfs.sh

@@ -11,13 +11,13 @@
 # Usage:
 #   bash scripts/update-debug-rootfs.sh [rootfs_path]
 #
-# Defaults to /var/lib/wrenn/images/minimal.ext4
+# Defaults to /var/lib/wrenn/images/minimal/rootfs.ext4
 
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 PROJECT_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
-ROOTFS="${1:-/var/lib/wrenn/images/minimal.ext4}"
+ROOTFS="${1:-/var/lib/wrenn/images/minimal/rootfs.ext4}"
 MOUNT_DIR="/tmp/wrenn-rootfs-update"
 
 if [ ! -f "${ROOTFS}" ]; then
@@ -64,10 +64,42 @@ echo "==> Installing wrenn-init..."
 sudo cp "${PROJECT_ROOT}/images/wrenn-init.sh" "${MOUNT_DIR}/usr/local/bin/wrenn-init"
 sudo chmod 755 "${MOUNT_DIR}/usr/local/bin/wrenn-init"
 
+echo "==> Installing tini..."
+TINI_BIN=""
+# 1. Already in the rootfs?
+for p in "${MOUNT_DIR}/usr/bin/tini" "${MOUNT_DIR}/sbin/tini" "${MOUNT_DIR}/usr/local/bin/tini"; do
+    if [ -f "$p" ]; then TINI_BIN="$p"; break; fi
+done
+# 2. Available on the host?
+if [ -z "${TINI_BIN}" ]; then
+    for p in /usr/bin/tini /usr/local/bin/tini /sbin/tini; do
+        if [ -f "$p" ]; then TINI_BIN="$p"; break; fi
+    done
+fi
+# 3. Download from GitHub releases.
+if [ -z "${TINI_BIN}" ]; then
+    ARCH="$(uname -m)"
+    case "${ARCH}" in
+        x86_64)  TINI_ARCH="amd64" ;;
+        aarch64) TINI_ARCH="arm64" ;;
+        *)        echo "ERROR: Unsupported architecture: ${ARCH}"; exit 1 ;;
+    esac
+    TINI_VERSION="v0.19.0"
+    TINI_URL="https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini-${TINI_ARCH}"
+    TINI_TMP="/tmp/tini-${TINI_ARCH}"
+    echo "    Downloading tini ${TINI_VERSION} (${TINI_ARCH})..."
+    curl -fsSL "${TINI_URL}" -o "${TINI_TMP}"
+    chmod +x "${TINI_TMP}"
+    TINI_BIN="${TINI_TMP}"
+fi
+sudo mkdir -p "${MOUNT_DIR}/sbin"
+sudo cp "${TINI_BIN}" "${MOUNT_DIR}/sbin/tini"
+sudo chmod 755 "${MOUNT_DIR}/sbin/tini"
+
 # Step 4: Verify.
 echo ""
 echo "==> Installed files:"
-ls -la "${MOUNT_DIR}/usr/local/bin/envd" "${MOUNT_DIR}/usr/local/bin/wrenn-init"
+ls -la "${MOUNT_DIR}/usr/local/bin/envd" "${MOUNT_DIR}/usr/local/bin/wrenn-init" "${MOUNT_DIR}/sbin/tini"
 
 echo ""
 echo "==> Done. Rootfs updated: ${ROOTFS}"