[Unit]
Description=Kodi user autostart script
Before=kodi.service
After=network-online.target graphical.target
...
[Install]
WantedBy=kodi.service
^ that explains when autostart.sh is run; after the network is online but before Kodi starts. It used to be at the start of userspace boot (much earlier) but users were always trying to schedule things that depended on the network so it was changed.
The contents of /run are (re)created at boot time based on scripts embedded in the read-only SYSTEM file (which expands on boot to create userspace) so all changes made there are intentionally lost on shutdown. The resolv.conf file is also managed by ConnMan so any changes to it can/will be overwritten when ConnMan feels like it, and since everything in the OS including ConnMan runs as root changing file perms to prevent changes to the file probably won't achieve much as you cannot restrict change from root.
The correct way to effect change to resolve.conf is making changes through ConnMan, using connmanctl. If you need to e.g. reorder services to ensure the tunnel has priority, you may need to execute a sequence of reorder commands to move things around into the correct sequence. Such things are a bit clunky, but ConnMan was originally created for phone devices where such wizardry isn't needed, so it's not blessed with highly scriptable controls.
In terms of boot timing: /run/libreelec/resolv.conf is created by the connman-setup script which is executed by connman.service. If you want to understand more about OS plumbing and boot scripts the easiest method (as I have just done myself) is to "git clone" our sources and then use "git grep" in the sources folder to find mentions of binaries and paths.