Hey @basti,
I believe I have figured out this problem. Please read my post here: SPI service sometimes fails to start when run in sandbox mode
You can “solve” this problem by modifying $LEGATO_ROOT/apps/platformServices/spiService.adef to specify sandbox: false and removing or commenting the the requires section for /dev/spidev0.0 (see gist). Clean and re-compile Legato for good measure.
Keep in mind this compromises security to some extent. A better solution would involve waiting for /dev/spidev0.0 to be ready before starting the supervisor as discussed in the post above.