read privateUsers from the closure record at start, and move the data owner option under hive-controller

hive-priv/src/main.rs

@@ -391,18 +391,23 @@ async fn exec(
             isolation,
             load_credentials,
             hive_facts,
+            private_users,
         } => {
             container_config::handle_write_nspawn_flags_blocking(
                 container,
                 binds,
                 isolation,
                 load_credentials,
-                hive_facts,
+                *hive_facts,
+                private_users,
             )
             .await
         }
 
-        PrivRequest::EnsureAgentSocketDir { ref name } => files::ensure_agent_socket_dir(name),
+        PrivRequest::EnsureAgentSocketDir {
+            ref name,
+            private_users,
+        } => files::ensure_agent_socket_dir(name, private_users),
 
         PrivRequest::WriteResourceLimits {
             ref container,