feat(#2290): split ensure_runtime — dirs to lifecycle, listeners to mcp_sockets supervisor

- lifecycle::ensure_agent_runtime_dir(name): pure filesystem op, no
  Coordinator dep. Creates /run/hyperhive/agents/<name> without touching
  the MCP listener map.

- workers/mcp_sockets::spawn_poll(coord): 10 s reconcile loop (same shape
  as agent_sockets::spawn_poll). Converges 'agent running => MCP listener
  bound'. First tick is immediate so hive-c0re restarts re-register all
  running agents without waiting a full interval. Fixes the dead-listener-
  after-daemon-restart gap.

- All ensure_runtime() call sites updated:
  - Prebuild/Swap/WriteDropin: Coordinator::agent_dir() (pure, no IO)
  - Reconcile-Start: ensure_agent_runtime_dir + agent_dir (dir may be
    missing after reboot; listener deferred to supervisor)
  - run_create / handle_spawn: ensure_agent_runtime_dir + register_agent
    (eager on first spawn so socket ready before harness first turn)
  - apply_commit / merge_config_pr: ensure_agent_runtime_dir + agent_dir
  - Manager (auto_update): ensure_agent_runtime_dir + agent_dir
    (manager has no MCP listener; socket_server::start_manager owns it)

- ensure_runtime() retained in Coordinator with updated doc pointing at
  the preferred split form. No callers remain outside tests.

hive-c0re/src/lifecycle/mod.rs

@@ -749,6 +749,23 @@ pub async fn sync_tmpfiles() {
     }
 }
 
+/// Ensure the per-agent runtime directory `/run/hyperhive/agents/<name>`
+/// exists. The directory is also written by `SyncAgentTmpfiles` (run at
+/// boot + spawn/destroy), but explicit creation in start/spawn paths guards
+/// against races where hive-c0re starts a container before tmpfiles.d has
+/// applied the new entry.
+///
+/// Pure filesystem op — no `Coordinator` dependency — so callers that only
+/// need the dir do not have to hold an `Arc<Coordinator>`.
+///
+/// # Errors
+/// Returns an error if `create_dir_all` fails.
+pub fn ensure_agent_runtime_dir(name: &str) -> Result<()> {
+    let dir = std::path::PathBuf::from(format!("/run/hyperhive/agents/{name}"));
+    std::fs::create_dir_all(&dir)
+        .with_context(|| format!("create agent runtime dir {}", dir.display()))
+}
+
 /// Build the per-line callback for `create_container_streaming` /
 /// `update_container_streaming`. Both ops share identical dispatch logic
 /// (stdout → info + `append_stdout`, stderr → warn + `append_stderr`); this