kata-sys-util: run OCI hooks by their absolute path

Hooks were spawned by PATH-searching `args[0]`. After `env_clear()` a bare
argv[0] only resolves against the compiled-in default PATH (/bin:/usr/bin),
so a hook binary living elsewhere - e.g. a composable-image extension under
/run/kata-extensions/<name>/bin - failed to start with ENOENT.

Execute the hook's `path` instead (an absolute path, already validated in
`new`), passing `args` as argv with argv[0] = args[0]. This matches OCI
runtime-spec semantics and lets hooks run from any location.

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>
Assisted-by: Cursor <cursoragent@cursor.com>

src/libs/kata-sys-util/src/hooks.rs

@@ -250,9 +250,15 @@ impl<'a> HookExecutor<'a> {
 
     /// Spawn the subprocess, optionally feeding `state` to its stdin.
     fn spawn(&self, state: Option<&runtime_spec::State>) -> Result<Job> {
-        let mut exec = Exec::cmd(&self.args[0])
+        // Execute the hook's `path` (an absolute path, validated in `new`) directly.
+        // Using `args[0]` as the command would PATH-search a bare program name, which
+        // only resolves when the binary lives in the compiled-in default PATH
+        // (/bin:/usr/bin) after `env_clear()` - so hooks outside it (e.g. a composable
+        // image extension under /run/kata-extensions/<name>/bin) fail with ENOENT.
+        // OCI semantics: run `path`, with `args` as argv (argv[0] = args[0]).
+        let mut exec = Exec::cmd(&self.executable)
             .args(&self.args[1..])
-            .arg0(&self.executable)
+            .arg0(&self.args[0])
             .env_clear()
             .env_extend(
                 self.envs