fleet-manager: locate lego at /lego in the acme side-car

The goacme/lego image ships the binary at /lego, not on PATH, so the bare `lego`
call failed ("not found") once the entrypoint was overridden with the shell.
Detect it (command -v, then /lego fallback) and invoke via $LEGO.

serving/fleet-manager/acme/renew-loop.sh

@@ -26,6 +26,12 @@ STAGING=""
   echo "acme: using LE STAGING — certs are UNTRUSTED (dry run)"
 }
 
+# The goacme/lego image ships the binary at /lego (not on PATH); fall back to it
+# when we've overridden the entrypoint with the shell.
+LEGO=$(command -v lego 2>/dev/null || true)
+[ -z "$LEGO" ] && [ -x /lego ] && LEGO=/lego
+[ -z "$LEGO" ] && { echo "acme: FATAL lego binary not found (looked on PATH and /lego)"; exit 1; }
+
 while true; do
   # First pass issues; later passes renew when near expiry.
   if [ -f "/le/certificates/$DOMAIN.crt" ]; then
@@ -36,7 +42,7 @@ while true; do
   echo "acme: lego $* for $DOMAIN (Route 53 DNS-01)"
 
   # shellcheck disable=SC2086  # $STAGING is intentionally two words when set
-  if lego --accept-tos --email "$EMAIL" --dns route53 --domains "$DOMAIN" \
+  if "$LEGO" --accept-tos --email "$EMAIL" --dns route53 --domains "$DOMAIN" \
           --path /le $STAGING "$@"; then
     install -m 644 "/le/certificates/$DOMAIN.crt" /out/fullchain.pem
     install -m 600 "/le/certificates/$DOMAIN.key" /out/privkey.pem