run agent containers on an ephemeral root, salvaging the old one first

hive-priv copies a stopped container's root to the agent's work dir and
renames it aside before passing nspawn --ephemeral; the agent's nix state
moves to the persistent profiles bind. Adds the agent-ephemeral-rootfs vm
test and a module-eval case for the nix state redirect.

hive-priv-sock/src/lib.rs

@@ -330,6 +330,11 @@ pub enum PrivRequest {
     /// Always writes `PRIVATE_NETWORK=1` + veth wiring: isolation is the only
     /// mode, so there is no request shape that yields a container sharing the
     /// host's network namespace.
+    ///
+    /// Also decides whether the container runs on an ephemeral root. When it is
+    /// stopped and its root holds anything beyond caches, the root is copied to
+    /// the agent's `work/` and renamed aside first, then `--ephemeral` is added
+    /// to the flags; see `hive-priv/src/rootfs.rs`.
     WriteNspawnFlags {
         container: String,
         binds: Vec<BindMount>,