fix(pi3): velxio-init v2 — wait for /dev/ttyAMA1, exec on /dev/console

The previous velxio-init was racing devtmpfs population: its bash
redirect '</dev/ttyAMA1 >/dev/ttyAMA1' fired before the kernel had
enumerated the PL011 driver and populated the device node, so PID 1's
fd 0/1/2 redirect failed and the `while true` loop spun on
"No such file or directory" forever.

Two fixes baked into the SD image:

1. Wait up to 12 s for /dev/ttyAMA1 to appear (200 ms poll × 60).
   On real bare-metal Pi the node is there at init time, but
   under QEMU emulation the PL011 probe races.

2. Exec the shell with </dev/console >/dev/console — /dev/console is
   set up by the kernel (no race) and points at the last `console=`
   arg from the cmdline, which is ttyAMA1. Also wrap in `setsid -c`
   so bash gets a controlling terminal and behaves interactively.

Verified end-to-end with a live QEMU boot against the patched .img:
shell prompt `root@raspberrypi:/#` appears within ~50 s wall (most
of that is the kernel waiting on the second SD slot mmc1 timeout
twice = 20 s).

backend/app/services/boot_images/manifest.json

@@ -22,13 +22,13 @@
         {
           "name": "raspios-trixie-armhf.img",
           "asset_id": "raspios-trixie-armhf-zst",
-          "sha256": "8963dbfafa2b0e4673499a74cc9fc0dcb8da49d023e6d340301d071abd07bba8",
+          "sha256": "0606578f5a6054004f9466bbeaa99131eacef0c2d3ab7317c2ed22373ce16277",
           "size_bytes": 5729419264,
-          "version": "2026-04-21+velxio-init",
+          "version": "2026-04-21+velxio-init-v2",
           "compressed": {
             "encoding": "zstd",
-            "sha256": "8e0eca1865c4a32bbe096044e8ea1d9adeb80f3ffe9fe2f45a54881f7020266d",
-            "size_bytes": 1488007156
+            "sha256": "739f4186de775a44f81e4e34a8db2bd76c54ca59e68bd51ca17c36594fa54b4c",
+            "size_bytes": 1488006498
           }
         }
       ]