Ensure /run is created before mounting secrets

Otherwise /run/agenix might disappear if specialfs is toposorted
between agenixMountSecrets and agenixRoot.

Fixes: https://github.com/ryantm/agenix/issues/92

modules/age.nix

@@ -147,7 +147,8 @@ in
     # Create a new directory full of secrets for symlinking (this helps
     # ensure removed secrets are actually removed, or at least become
     # invalid symlinks).
-    system.activationScripts.agenixMountSecrets = ''
+    system.activationScripts.agenixMountSecrets = {
+      text = ''
         _agenix_generation="$(basename "$(readlink /run/agenix)" || echo 0)"
         (( ++_agenix_generation ))
         echo "[agenix] symlinking new secrets to /run/agenix (generation $_agenix_generation)..."
@@ -163,6 +164,10 @@ in
           rm -rf "${cfg.secretsMountPoint}/$(( _agenix_generation - 1 ))"
         }
       '';
+      deps = [
+        "specialfs"
+      ];
+    };
 
     # Secrets with root owner and group can be installed before users
     # exist. This allows user password files to be encrypted.