lifecycle: make the agent-uid lookup say which failure it hit

`agent_uid_gid` returns `None` for all 13 agents on every sync, and the
tmpfiles caller answers that `None` by writing `d /run/hive-agent/<name>
0777 root root` instead of `0751 <uid> <gid>` — a world-writable socket
dir, which docs/trust-boundary/boundary.md spells out as letting anything
that can reach the path unlink an agent's socket and bind its own.

Which failure fires could not be determined, because the read used
`.ok()?` and collapsed every io::Error into the same `None` a missing
user produces. None of the three causes the doc comment enumerated (not
built yet, unparseable, missing user) fits 13 long-lived containers whose
agent user demonstrably exists — from inside one:

    srw-rw-rw- atlas atlas /run/hive-agent/atlas/agent.sock

So the live cause was outside the documented set and unidentifiable. Both
`None` arms now log, with the path and the error.

Splitting the pure parser out to make it testable surfaced a second,
narrower bug. The old scan used `?` on the field reads, and those are
only reached once the name matches — so an unusable row *for the wanted
user* returned `None` from the whole function instead of skipping, hiding
a usable entry below it. (Rows for other users were always skipped fine:
`split(':')` always yields at least one item, so the first `?` could not
fire.) It now skips unusable rows and keeps looking.

Does not pre-empt #3047, which removes the lookup entirely and stays
blocked on #3998; this only makes the lookup honest about failing while
it exists.

Closes #4197.

hive-c0re/src/lifecycle/tests.rs

@@ -282,3 +282,47 @@ fn an_unknown_state_is_never_reported_as_failed() {
         );
     }
 }
+
+/// A malformed row for the wanted user must not end the scan.
+///
+/// The old implementation used `?` on the field reads, which are only reached
+/// once the name matches — so a short or unparseable row *for this agent*
+/// returned `None` from the whole function and hid a usable entry below it.
+/// The caller answers that `None` by declaring the socket dir `0777`.
+#[test]
+fn passwd_parse_keeps_scanning_past_a_malformed_row_for_the_same_user() {
+    // The two `atlas` rows above the real one are what matters: a malformed
+    // row for the SAME user is what used to end the scan, so the usable entry
+    // below it was never reached. Rows for other users were always skipped
+    // fine. Both unusable shapes are here because they leave the parser by
+    // different arms — missing fields, and fields that will not parse — and a
+    // mutation run showed the second arm untested when only the first was.
+    let body = "\
+root:x:0:0:System administrator:/root:/bin/sh
+# a comment line, not a passwd entry
+atlas:x
+atlas:x:notanumber:994::/:/bin/sh
+atlas:x:1000:994:atlas:/home/atlas:/bin/sh
+";
+    assert_eq!(parse_passwd_uid_gid(body, "atlas"), Some((1000, 994)));
+    // Control: the same body must NOT answer for a user it does not carry,
+    // or the assertion above is satisfied by any parse at all.
+    assert_eq!(parse_passwd_uid_gid(body, "nobody-here"), None);
+}
+
+/// A matching name with unusable ids is not a match. Without this the parser
+/// could return a partly-parsed row and the caller would chown to it.
+#[test]
+fn passwd_parse_rejects_unusable_ids() {
+    assert_eq!(
+        parse_passwd_uid_gid("atlas:x:notanumber:994::/:/bin/sh", "atlas"),
+        None
+    );
+    assert_eq!(parse_passwd_uid_gid("atlas:x:1000", "atlas"), None);
+    assert_eq!(parse_passwd_uid_gid("", "atlas"), None);
+    // Presence control for the three absences above.
+    assert_eq!(
+        parse_passwd_uid_gid("atlas:x:1000:994::/:/bin/sh", "atlas"),
+        Some((1000, 994))
+    );
+}