hive-c0re: fail on an unparseable resource-limits or topology file, write both atomically

resource-limits.json and topology.json were read with parse errors
folded into an empty map, and written in place with std::fs::write. One
truncated resource-limits.json followed by a single set_limits call
rewrote the file with only that agent's entry, erasing every other
agent's CPU and memory overrides without a log line. topology.json had
the same shape: reconcile rebuilt it from the live set, losing pending
(provisioned, never spawned) names.

- agent_config::read_map / write_map are generic over the stored type.
  tool-groups and capabilities behave as before.
- resource_limits::read / effective return an error for an existing but
  unreadable file; a missing file is still the empty map. set_limits
  fails without writing on such a file, and writes atomically.
- topology: reconcile fails without writing on an unreadable file and
  writes atomically. all_agents logs the error and returns no agents,
  so a ManageRootAgent holder starts without cross-agent mounts.

Read-path behaviour on an unreadable resource-limits.json, per caller:
- write_dropins (every spawn / swap / WriteDropin): logs the error and
  keeps the limits drop-in already under /run; the agent still starts.
  With no drop-in yet (first start since boot) it writes the hive
  defaults, because no drop-in means an uncapped container.
- render_flake: propagates, so sync_agents (and spawn/rebuild/destroy
  jobs) fail. An empty map would give tighter-capped agents the hive
  memoryMaxBytes.
- container_view::build_all: logs the error each scan and renders the
  rows at the hive defaults (no ContainerView wire change).
- set_resource_limits reply: propagates.

Closes #4731

hive-c0re/src/agent_config/mod.rs

@@ -14,18 +14,20 @@ pub mod resource_limits;
 pub mod tool_groups;
 pub mod topology;
 
-use std::collections::BTreeMap;
 use std::io::{self, Write as _};
 use std::path::Path;
 
-/// Read a per-agent `name → [string]` JSON map. A missing file is the
-/// empty map; any other read failure, or content that doesn't parse, is
-/// an error, so a read-modify-write can't write back a map that has lost
-/// every other agent's entry.
-fn read_map(path: &Path) -> io::Result<BTreeMap<String, Vec<String>>> {
+use serde::Serialize;
+use serde::de::DeserializeOwned;
+
+/// Read one of these JSON registries. A missing file is `T::default()`
+/// (the empty map or set); any other read failure, or content that
+/// doesn't parse, is an error, so a read-modify-write can't write back a
+/// registry that has lost every other agent's entry.
+fn read_map<T: DeserializeOwned + Default>(path: &Path) -> io::Result<T> {
     let raw = match std::fs::read_to_string(path) {
         Ok(raw) => raw,
-        Err(e) if e.kind() == io::ErrorKind::NotFound => return Ok(BTreeMap::new()),
+        Err(e) if e.kind() == io::ErrorKind::NotFound => return Ok(T::default()),
         Err(e) => {
             return Err(io::Error::new(
                 e.kind(),
@@ -41,13 +43,13 @@ fn read_map(path: &Path) -> io::Result<BTreeMap<String, Vec<String>>> {
     })
 }
 
-/// Serialise `map` as pretty JSON and replace `path` with it atomically:
+/// Serialise `value` as pretty JSON and replace `path` with it atomically:
 /// a temp file in the same directory (`rename(2)` is only atomic within a
 /// filesystem), fsynced, renamed over `path`, then the directory fsynced
 /// so the rename itself survives a crash. A reader sees the old file or
 /// the new one, never a truncated one.
-fn write_map(path: &Path, map: &BTreeMap<String, Vec<String>>) -> io::Result<()> {
-    let text = serde_json::to_string_pretty(map)
+fn write_map<T: Serialize + ?Sized>(path: &Path, value: &T) -> io::Result<()> {
+    let text = serde_json::to_string_pretty(value)
         .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;
     let (Some(dir), Some(name)) = (path.parent(), path.file_name()) else {
         return Err(io::Error::new(
@@ -67,8 +69,12 @@ fn write_map(path: &Path, map: &BTreeMap<String, Vec<String>>) -> io::Result<()>
 
 #[cfg(test)]
 mod tests {
+    use std::collections::BTreeMap;
+
     use super::*;
 
+    type Map = BTreeMap<String, Vec<String>>;
+
     #[test]
     fn write_map_round_trips_and_leaves_no_temp_file() {
         let dir = tempfile::tempdir().expect("tempdir");
@@ -77,7 +83,7 @@ mod tests {
         write_map(&path, &map).expect("first write");
         let replaced = BTreeMap::from([("bob".to_owned(), vec!["inbox".to_owned()])]);
         write_map(&path, &replaced).expect("replacing write");
-        assert_eq!(read_map(&path).expect("read"), replaced);
+        assert_eq!(read_map::<Map>(&path).expect("read"), replaced);
         let entries: Vec<_> = std::fs::read_dir(dir.path())
             .expect("read_dir")
             .map(|e| e.expect("entry").file_name())
@@ -88,7 +94,8 @@ mod tests {
     #[test]
     fn read_map_of_a_missing_file_is_empty() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let map = read_map(&dir.path().join("absent.json")).expect("missing file is not an error");
+        let map =
+            read_map::<Map>(&dir.path().join("absent.json")).expect("missing file is not an error");
         assert!(map.is_empty());
     }
 
@@ -97,7 +104,7 @@ mod tests {
         let dir = tempfile::tempdir().expect("tempdir");
         let path = dir.path().join("map.json");
         std::fs::write(&path, "{\n  \"alice\": [\"messag").expect("seed");
-        let err = read_map(&path).expect_err("truncated JSON must not read as a map");
+        let err = read_map::<Map>(&path).expect_err("truncated JSON must not read as a map");
         assert_eq!(err.kind(), io::ErrorKind::InvalidData);
     }
 }