For some strange reason, this was not needed with systemd v208. But it's needed with systemd v215 on current Debian sid, and entirely makes sense.
@@ -22,6 +22,7 @@ InaccessibleDirectories = /home
ReadOnlyDirectories = /
ReadWriteDirectories = @LOCALSTATEDIR@/lib/tor
ReadWriteDirectories = @LOCALSTATEDIR@/log/tor
+ReadWriteDirectories = @LOCALSTATEDIR@/run/tor
NoNewPrivileges = yes
[Install]