run the root check warn-only on hyperhive's own containers, per unit, not on the container@ template

hive-priv/src/shared.rs

@@ -75,7 +75,7 @@ pub(crate) fn ensure_plain_filename(who: &str, filename: &str) -> Result<()> {
 /// The leading dot and the `.partial` suffix are load-bearing: a reader
 /// globbing on a published name's prefix, or systemd reading `*.conf` out of
 /// `tmpfiles.d` and drop-in dirs, cannot pick up a half-written temp.
-fn partial_name(filename: &str) -> String {
+pub(crate) fn partial_name(filename: &str) -> String {
     use std::sync::atomic::{AtomicU64, Ordering};
     static SEQ: AtomicU64 = AtomicU64::new(0);
     let n = SEQ.fetch_add(1, Ordering::Relaxed);