fix(#2031): move bash-tasks + events vacuum agent-side (privsep ownership)

hive-c0re/src/main.rs

@@ -12,9 +12,9 @@ use hive_sh4re::{HostRequest, HostResponse};
 // explicit (any new daemon entry point reads off the next add).
 use hive_c0re::coordinator::{Coordinator, HiveEnv, ServeConfig};
 use hive_c0re::{
-    agent_sockets, auto_update, bash_tasks_vacuum, broker, client, crash_watch, dashboard,
-    dashboard_events, events_vacuum, forge, knowledge, matrix, migrate, rebuild_queue,
-    reminder_scheduler, scheduled_prompts_worker, server, socket_server,
+    agent_sockets, auto_update, broker, client, crash_watch, dashboard, dashboard_events, forge,
+    knowledge, matrix, migrate, rebuild_queue, reminder_scheduler, scheduled_prompts_worker,
+    server, socket_server,
 };
 
 #[derive(Parser)]
@@ -385,15 +385,13 @@ async fn cmd_serve(
             }
         }
     });
-    // Per-agent events.sqlite vacuum: host-side so the harness
-    // doesn't need any retention wiring of its own.
-    events_vacuum::spawn(&coord);
+    // Per-agent events.sqlite + bash-tasks file cleanup now runs
+    // agent-side in the harness (`hive_ag3nt::vacuum`): the files are
+    // agent-owned, so host-side deletes hit PermissionDenied / readonly-db
+    // under privsep. See issue tracker "perms borked".
     // (turn-stats.sqlite has no vacuum — it's one tiny row per turn,
     // ~hundreds of KB, and the /stats + hive-stats views read it
     // directly; pruning it would just lose trend history for no gain.)
-    // Per-agent bash-tasks file vacuum: host-side so the harness
-    // cannot disable it. Deletes terminal task trios older than 48h.
-    bash_tasks_vacuum::spawn(&coord);
     // Slow per-container disk sampler: a `du` of each agent's state dir
     // + writable rootfs every ~5 min, cached so the 5s container-load
     // poll stays cheap cgroup-only reads. Feeds `disk_bytes` on the LOAD