Use direct path to vlatai to placate selinux

* Also, fail more gracefully if vlatai not actually executed