setup: fix LLM fallback config patch

[ai-hpc]

Summary

• Read [services.llm].backend through sudo awk after setup locks geniepod.toml down to 0600.
• Make patch_services_llm_backend read the root-owned config through sudo and return errors on read/install failures.
• Check both auto-fallback patch calls and abort setup instead of enabling services against an unpatched config.
• Add a focused regression test pinning the privileged read + checked fallback behavior.

Tests

• bash -n deploy/setup-jetson.sh
• cargo test -p genie-core --test tool_dispatch_test setup_script_privileged_llm_backend_patch_is_checked
• git diff --check

Closes #65

[ai-hpc]

Post-merge validation notes:

• CI was green before merge: fmt, clippy, tests, no-default-features axis, aarch64 release build, ruff, and shellcheck.
• Jetson setup path was validated with the v1.0.0 genie-ai-runtime release assets: binaries downloaded, SHA256 checks passed, config selected backend = "genie_ai_runtime" and systemd_unit = "genie-ai-runtime.service".
• Runtime health passed with Qwen3-4B on genie-ai-runtime.
• start_all.sh / stop_all.sh deployed cleanly; start_all now queues warmup oneshots with --no-block and exits normally.

Merged as 32dea9d. Follow-up runtime note: the latest board check still reported genie-core offline, so that should be diagnosed from genie-core logs separately from issue #65.