host, router: safe bin-overrides for merged-usr + controller re-resolve

[phaus]

Summary

• host: bin-overrides injection now detects Debian merged-usr base images (/bin → usr/bin symlink) and writes overrides into usr/bin in the overlay upperdir. Previously the unconditional MkdirAll(diffDir/bin) shadowed the symlink, hiding /usr/bin from every process and crash-looping apps (fixes the fork/exec /runner/init: no such file or directory regression observed on the lab cluster when bin-overrides was used). Adds a layerMergedUsr unit test.
• router: ControllerStore no longer pins the first discoverd controller instance at startup. List()/Watch() now re-resolve the live instance set on every call and fall through all instances until one accepts the request. This fixes the router silently missing route/cert updates after the controller it was connected to dies/is replaced (symptom: tlsv1 alert internal error on new HTTPS routes).

Verification

• go build ./router ./host both pass.
• go test -run TestLayerMergedUsr -v ./host passes (4 subcases).
• Cluster workaround for the same bugs (manual router restart) documented in the repo's implementation plan.