fix: split WriteAgentStateFile into WriteAgentForgeToken + WriteAgentMatrixToken

Addresses mara's review: each credential type gets its own PrivRequest
variant, making the exact priv surface visible in the wire protocol.
No runtime filename dispatch — the operation name is the gate.

- WriteAgentForgeToken { agent_name, token } → state/forge-token
- WriteAgentMatrixToken { agent_name, token } → state/matrix-token
- priv_client: two typed fns (write_agent_forge_token, write_agent_matrix_token)
- forge.rs: split mint_and_persist_token into mint_and_persist_agent_token
  (priv) + mint_and_persist_core_token (direct write); drop dead token_path fn
- matrix.rs: call write_agent_matrix_token directly

hive-c0re/src/matrix.rs

@@ -420,7 +420,7 @@ pub async fn ensure_user_for(
     // unprivileged `hive-core` user and cannot write to agent-owned state
     // directories directly. hive-priv writes the file 0600 and chowns it
     // to the agent user so it is readable from inside the container.
-    crate::priv_client::write_agent_state_file(name, "matrix-token", &format!("{access_token}\n"))
+    crate::priv_client::write_agent_matrix_token(name, &access_token)
         .await
         .with_context(|| format!("matrix: write matrix-token for {name} via hive-priv"))?;
     tracing::info!(%name, "matrix: provisioned access token");