fix: split WriteAgentStateFile into WriteAgentForgeToken + WriteAgentMatrixToken

Addresses mara's review: each credential type gets its own PrivRequest
variant, making the exact priv surface visible in the wire protocol.
No runtime filename dispatch — the operation name is the gate.

- WriteAgentForgeToken { agent_name, token } → state/forge-token
- WriteAgentMatrixToken { agent_name, token } → state/matrix-token
- priv_client: two typed fns (write_agent_forge_token, write_agent_matrix_token)
- forge.rs: split mint_and_persist_token into mint_and_persist_agent_token
  (priv) + mint_and_persist_core_token (direct write); drop dead token_path fn
- matrix.rs: call write_agent_matrix_token directly

hive-c0re/src/priv_client.rs

@@ -256,18 +256,26 @@ pub async fn run_forge_admin(args: &[&str]) -> Result<(String, String)> {
     check(call(&PrivRequest::RunForgeAdmin { args: owned }).await?)
 }
 
-/// Write `content` to `<agent_state_root>/<agent_name>/state/<filename>`
-/// via hive-priv (running as root). The file is written 0600 and chowned
-/// to the agent user so it is readable from inside the agent container.
-///
-/// Used for credential files (forge-token, matrix-token) that hive-c0re
-/// mints but cannot write directly because those paths are inside agent-
-/// owned (0755) state directories and hive-c0re runs unprivileged.
-pub async fn write_agent_state_file(agent_name: &str, filename: &str, content: &str) -> Result<()> {
-    ok(call(&PrivRequest::WriteAgentStateFile {
+/// Write the Forgejo access token for `agent_name` to
+/// `<agent_state_root>/<agent_name>/state/forge-token` via hive-priv
+/// (running as root). The file is written 0600 and chowned to the agent
+/// user so it is readable from inside the agent container.
+pub async fn write_agent_forge_token(agent_name: &str, token: &str) -> Result<()> {
+    ok(call(&PrivRequest::WriteAgentForgeToken {
         agent_name: agent_name.to_owned(),
-        filename: filename.to_owned(),
-        content: content.to_owned(),
+        token: token.to_owned(),
+    })
+    .await?)
+}
+
+/// Write the Matrix access token for `agent_name` to
+/// `<agent_state_root>/<agent_name>/state/matrix-token` via hive-priv
+/// (running as root). The file is written 0600 and chowned to the agent
+/// user so it is readable from inside the agent container.
+pub async fn write_agent_matrix_token(agent_name: &str, token: &str) -> Result<()> {
+    ok(call(&PrivRequest::WriteAgentMatrixToken {
+        agent_name: agent_name.to_owned(),
+        token: token.to_owned(),
     })
     .await?)
 }