fix(#2031): move bash-tasks + events vacuum agent-side (privsep ownership)

hive-c0re/src/hive_stats.rs

@@ -12,7 +12,8 @@
 //! be lifted into a shared crate — overkill for now.
 //!
 //! Privsep: the sqlite files are mode 0644 owned by the agent user;
-//! `hive-core` reads them fine (same as `events_vacuum`). We open
+//! `hive-core` can read them fine, but cannot write/delete (which is why
+//! retention sweeps run agent-side in the harness, not here). We open
 //! read-only so an in-flight harness writer never blocks us.
 
 use std::collections::HashMap;