make a userns data move resumable and refuse before the first chown

docs/agent-lifecycle/persistence.md

@@ -498,6 +498,13 @@ leaves the agent as it is.
   is on a tmpfs, so `EnsureAgentSocketDir` hands it to `dataOwner` at every
   start. The walk works by open directory fd and follows no link, so an agent
   or manager that can write the dirs can't redirect it to a host path.
+- **A move that fails starts over.** hive-priv opens all four dirs and
+  checks the agent's ids before the first chown, so a link or file where a dir
+  goes refuses with nothing changed. It then writes the ids to
+  `/var/lib/hive-priv/userns/<name>.pending`. If the walk fails after that (a
+  chown error, a tree nested too deep), the next start repeats it from those
+  ids, then writes the marker and removes the pending file. hive-priv refuses a
+  pending file that doesn't hold `<owner> <uid> <gid>`, and names it.
 - **The agent's gid must equal its uid.** `owneridmap` maps the gid of a bind
   with the uid map, so a group other than the uid's has no mapping and writes
   fail. The agent module asserts that `user.uid` and `user.gid` hold the
@@ -506,7 +513,8 @@ leaves the agent as it is.
   gid than uid, naming the agent.
 - **Turning it off is manual.** hive-priv refuses to start an agent whose
   marker exists while its record says false, and one whose `dataOwner`
-  changed. Chown the four dirs back, then delete the marker.
+  changed. Chown the four dirs back, then delete the marker and any
+  `<name>.pending` beside it.
 - **Keep a `ManageRootAgent` holder off it.** The other agents' dirs it mounts
   aren't remapped.