fix(#2031): move bash-tasks + events vacuum agent-side (privsep ownership)

hive-ag3nt/src/bin/hive.rs

@@ -429,6 +429,10 @@ async fn serve_main<S: Surface>(socket: &Path, poll_ms: u64) -> Result<()> {
         S::send_to_parent(socket, failure).await;
     }
     tokio::spawn(hive_ag3nt::forge_notify::run(socket.to_path_buf()));
+    // Agent-side cleanup of this agent's own harness artifacts (completed
+    // bash-task files + verbose event rows). Runs here, not host-side in
+    // hive-c0re, because the files are agent-owned — see `vacuum` module docs.
+    tokio::spawn(hive_ag3nt::vacuum::run());
     // Log web_ui::serve's error instead of dropping it. A bare
     // `tokio::spawn(web_ui::serve(...))` discards the JoinHandle, so
     // any Err (e.g. EACCES from `bind_unix` when HIVE_WEB_SOCKET points