elastic-agent-complete-wolfi:9.4.3 does not start in Azure Container Apps, while 9.4.2 works

## Bug: `elastic-agent-complete-wolfi:9.4.3` does not start in Azure Container Apps, while `9.4.2` works

### Summary

After upgrading from `elastic-agent-complete-wolfi:9.4.2` to `elastic-agent-complete-wolfi:9.4.3`, the Elastic Agent container no longer starts properly in Azure Container Apps.

Rolling back to `9.4.2` immediately fixes the issue.

The visible log output shows:

```text
agent container initialisation - effective capabilities
agent container initialisation - ambient capabilities
agent container initialisation - chown paths
Warning: cannot chown agent paths without CAP_CHOWN or CAP_DAC_OVERRIDE capabilities
````

The warning itself appears to be non-fatal but with `9.4.3` the container becomes unusable / does not complete startup.

### Environment

* Elastic Agent image: `elastic-agent-complete-wolfi`
* Working version: `9.4.2`
* Failing version: `9.4.3`
* Runtime: Azure Container Apps
* Container type: non-privileged container
* Use case: Elastic Agent Complete is required for browser-based synthetic monitoring
* Capabilities: Azure Container Apps does not allow adding Linux capabilities such as `CAP_CHOWN` or `CAP_DAC_OVERRIDE`

### Expected behavior

`elastic-agent-complete-wolfi:9.4.3` should start successfully in the same Azure Container Apps environment where `9.4.2` works.

The agent should either tolerate missing `CAP_CHOWN` / `CAP_DAC_OVERRIDE`, as the warning suggests, or provide a clear fatal error explaining which path/state/config operation failed.

### Actual behavior

`elastic-agent-complete-wolfi:9.4.3` does not start properly in Azure Container Apps.

The last visible startup-related messages are:

```text
agent container initialisation - effective capabilities
agent container initialisation - ambient capabilities
agent container initialisation - chown paths
Warning: cannot chown agent paths without CAP_CHOWN or CAP_DAC_OVERRIDE capabilities
```

After this, the container is no longer usable.

Rolling back to `elastic-agent-complete-wolfi:9.4.2` resolves the problem without any other configuration changes.

### Why this looks like a regression

The same Azure Container Apps configuration works with:

```text
elastic-agent-complete-wolfi:9.4.2
```

but fails with:

```text
elastic-agent-complete-wolfi:9.4.3
```

### **_AI SLOP assumption incoming:_**

However, `9.4.3` introduced container-mode related changes, especially:

* `Read TLS config from environment variables in container mode`
* `Fix container config override inconsistencies`

The related PR appears to be:

```text
elastic/elastic-agent#14408
```

This looks like the `9.4.3` container-mode config/path handling may have exposed or introduced a startup failure in restricted container runtimes such as Azure Container Apps.

### Suspicion

The failure may be related to one of the following areas:

* container-mode config override ordering
* `fleet.enc` / encrypted Fleet config reload
* state/config path handling
* writable path assumptions
* ownership handling after the failed `chown`
* vault / secret storage initialization
* use of `CONFIG_PATH`, `STATE_PATH`, `DATA_PATH`, `HOME_PATH`, or `LOGS_PATH`

Since ACA does not allow adding the required Linux capabilities, the agent should be able to start without requiring `CAP_CHOWN` or `CAP_DAC_OVERRIDE`, especially if this worked in `9.4.2`.

### Impact

This blocks upgrading from `9.4.2` to `9.4.3` for Elastic Agent Complete on Azure Container Apps.

We need the `complete` image because browser-based synthetic monitoring requires it, so switching to the regular `elastic-agent-wolfi` image is not an option.

### Workaround

Rollback to:

```text
elastic-agent-complete-wolfi:9.4.2
```

### Request

Could you please check whether the container-mode config/path changes in `9.4.3`, especially around PR `#14408`, changed startup behavior for restricted container runtimes?

Start by reviewing elastic/elastic-agent#14408 and the container-mode startup changes between 9.4.2 and 9.4.3. Reproduce the failure in a non-privileged Azure Container Apps environment, then inspect handling of CONFIG_PATH, STATE_PATH, DATA_PATH, HOME_PATH, LOGS_PATH, and the chown warning. Done means the complete 9.4.3 image starts successfully without added Linux capabilities or reports a clear fatal error.

Written by the indexing model from the issue text.