walk an agent's dirs by fd when moving them, and refuse a gid that differs from the uid

docs/agent-lifecycle/persistence.md

@@ -478,11 +478,13 @@ can't switch it on or off.
   template owned by the agent user. A later request with the marker present
   chowns nothing. A running container waits for its next stop. The socket dir
   is on a tmpfs, so `EnsureAgentSocketDir` hands it to `dataOwner` at every
-  start.
+  start. The walk works by open directory fd and follows no link, so an agent
+  or manager that can write the dirs can't redirect it to a host path.
 - **The agent's gid must equal its uid.** `owneridmap` maps the gid of a bind
   with the uid map, so a group other than the uid's has no mapping and writes
   fail. Pin `services.hyperhive.agent.user.uid` and `.gid` to one number in the
-  agent's config before listing it.
+  agent's config, and start it once, before listing it. The move refuses an
+  agent whose `state` dir has another gid than uid, naming the agent.
 - **Leaving the list is manual.** hive-priv refuses to start an agent whose
   marker exists but who is no longer on the list, and one whose `dataOwner`
   changed. Chown the four dirs back, then delete the marker.