World-writable /var/run permits LPE in sidecar pattern

Default permissions on the runtime directory allow any container sharing the IPC namespace to escalate to redis user.

# Reproduction steps redacted under coordinated disclosure.
# Full PoC will be published with the advisory at embargo expiry.

$ zds reproduce ZDS-2025-0140