feat: pause an agent's turn loop without stopping its container

A paused agent keeps its container, its claude session and its
dashboard/todo servers up, but stops driving turns. Messages queue
unacked and are drained on resume.

The whole protocol is a single marker file, `<harness>/paused`. That
directory is already a bind-mount shared between host and container, so
both sides just stat the same path: the harness reads it to decide
whether to drive a turn, hive-c0re reads it to render the badge and
writes/removes it for `hivectl pause|resume`. No new wire protocol, no
container round-trip, and it is sticky across restarts by construction.

Not calling `recv_next` while paused *is* the queueing semantic, so
there is no fencing to get wrong: reminders buffer in their unbounded
channel, the todo `Notify` permit coalesces, and a `request_next_turn`
that raced the pause survives because the gate sits above
`self_continue.take()`.

Graceful stop is handled host-side rather than in the harness: a paused
agent provably has no turn in flight, so `run_signal` skips the fence
entirely instead of eating the full `GRACEFUL_STOP_TIMEOUT` waiting for
a checkpoint turn that will never run.

`paused` is reported on `ContainerView` / `AgentStatusRow` for the
dashboard, orthogonal to `running` and reported for stopped containers
too.

Closes: hyperhive/hyperhive issue 2271

hive-c0re/src/coordinator.rs

@@ -1444,6 +1444,50 @@ impl Coordinator {
         crate::paths::agent_state_dir(name).join("harness")
     }
 
+    /// Host-side path of the pause marker — the same file the harness
+    /// resolves in-container via `hive_sh4re::paths::paused_marker`,
+    /// reached through the harness bind-mount. Its presence means the
+    /// agent's turn loop is parked: the harness still serves its web UI
+    /// and MCP daemons, but drives no turns, so inbox messages queue up
+    /// unacked until the marker is removed.
+    ///
+    /// Both sides only ever *stat* or create/remove this file, so there
+    /// is no protocol between them and pause survives a container
+    /// restart (and can be set on a stopped container).
+    pub fn agent_paused_marker(name: &hive_types::Ident) -> PathBuf {
+        Self::agent_harness_dir(name).join(hive_sh4re::paths::PAUSED_MARKER_FILE)
+    }
+
+    /// Whether `name` is currently paused. A stat error (missing agent
+    /// dir, permissions) reads as "not paused" — the pause indicator is
+    /// advisory on the host side, and the harness is the component that
+    /// actually enforces it.
+    #[must_use]
+    pub fn is_paused(name: &hive_types::Ident) -> bool {
+        Self::agent_paused_marker(name).exists()
+    }
+
+    /// Create or remove the pause marker. Idempotent in both
+    /// directions: pausing an already-paused agent (or resuming a
+    /// running one) is a no-op rather than an error, so the dashboard
+    /// toggle and `hivectl pause|resume` don't have to read-then-write.
+    pub fn set_paused(name: &hive_types::Ident, paused: bool) -> std::io::Result<()> {
+        let marker = Self::agent_paused_marker(name);
+        if paused {
+            if let Some(parent) = marker.parent() {
+                std::fs::create_dir_all(parent)?;
+            }
+            // `create_new` would fail on the second pause; truncating an
+            // existing empty marker is the idempotent equivalent.
+            std::fs::write(&marker, b"")
+        } else {
+            match std::fs::remove_file(&marker) {
+                Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
+                other => other,
+            }
+        }
+    }
+
     /// Enumerate names that have a persistent state dir under
     /// `/var/lib/hyperhive/agents/` (i.e. config / claude creds /
     /// notes survive). Includes both currently-existing containers and