fix: declare the agent socket dir's owner in tmpfiles, not by chown after

/run/hive-agent/<name> was 0777 root root in steady state, not just during
first spawn. A directory without the sticky bit lets any user unlink files
in it, and the gateway container has all of /run/hive-agent bind-mounted
in, so anything that could reach the path could delete an agent's
agent.sock, bind its own, and receive that agent's todos from hive-c0re.

Two mechanisms were writing the dir and undoing each other: the tmpfiles.d
entry wrote 0777 root root, then hive-c0re round-tripped through hive-priv's
ChownSocketDir to narrow it. `d` re-asserts mode and owner on every apply
and the file is regenerated on any agent's spawn or destroy, so every such
event reset every agent's dir back to world-writable.

SyncAgentTmpfiles now carries each agent's container uid/gid and the entry
declares the answer: 0751 <uid> <gid>. Three principals need the dir and no
two share a group -- the harness binds its sockets (owner rwx), hive-c0re
dials agent.sock and the gateway's nginx dials web.sock (both only need
traverse, and both sockets are already 0666).

Deletes ChownSocketDir and ChmodSocketDir, both priv_client wrappers, the
either/or in host_config with its two swallowed warn!s, and the now-dead
socket_dir_path -- two verbs off the privileged helper's surface and one
round-trip off every agent spawn.

Also makes the two tmpfiles rules for /run/hive-agent itself agree: the
gateway module said hive-core, the generated file said root, and which won
depended on the order systemd read them in.

hive-c0re/src/lifecycle/mod.rs

@@ -712,6 +712,16 @@ pub async fn sync_tmpfiles() {
         Ok(containers) => containers
             .into_iter()
             .filter_map(|c| c.strip_prefix(AGENT_PREFIX).map(str::to_owned))
+            .map(|name| {
+                // Resolved here, not in hive-priv: the mapping lives in the
+                // container's /etc/passwd, which is c0re's to read. `None`
+                // until the container's first boot renders it.
+                let (uid, gid) = match agent_uid_gid(&name) {
+                    Some((uid, gid)) => (Some(uid), Some(gid)),
+                    None => (None, None),
+                };
+                hive_priv_sock::AgentTmpfilesEntry { name, uid, gid }
+            })
             .collect::<Vec<_>>(),
         Err(e) => {
             tracing::warn!(error = ?e, "sync_tmpfiles: list failed; skipping");