agents: define the work dir name once and test its creation

hive-c0re/src/lifecycle/host_config.rs

@@ -198,7 +198,7 @@ fn bind_own_agent_dirs(agent_name: &str, notes_dir: &Path, binds: &mut Vec<BindM
         read_only: false,
     });
     if let Some(state_parent) = notes_dir.parent() {
-        for sub in ["harness", "work"] {
+        for sub in ["harness", crate::paths::WORK_SUBDIR] {
             let dir = state_parent.join(sub);
             if !dir.exists() {
                 let _ = std::fs::create_dir_all(&dir);

hive-c0re/src/lifecycle/setup.rs

@@ -218,7 +218,7 @@ pub fn ensure_state_dir(notes_dir: &Path) -> Result<()> {
     }
     // Harness and work dirs are siblings of the agent-visible state dir.
     if let Some(parent) = notes_dir.parent() {
-        for sibling in ["harness", "work"] {
+        for sibling in ["harness", crate::paths::WORK_SUBDIR] {
             let dir = parent.join(sibling);
             if !dir.exists() {
                 std::fs::create_dir_all(&dir)

hive-c0re/src/lifecycle/tests.rs

@@ -410,3 +410,14 @@ async fn a_prebuild_inside_its_limit_returns_its_status() {
         .expect("a fast child must not time out");
     assert_eq!(status.code(), Some(3));
 }
+
+/// The setup path creates the agent's `work/` dir beside `state/`, so the
+/// bind source exists before nspawn starts the container.
+#[test]
+fn ensure_state_dir_creates_the_work_dir() {
+    let root = tempfile::tempdir().expect("tempdir");
+    let notes_dir = root.path().join("state");
+    ensure_state_dir(&notes_dir).expect("ensure_state_dir");
+    assert!(notes_dir.is_dir());
+    assert!(root.path().join(crate::paths::WORK_SUBDIR).is_dir());
+}