agent permissions: hold hive-c0re's stored grant until the agent's own read

Until its first successful read of its key, the harness read its
permissions as the default set, `execution` included. So did the
subagent daemon. An agent the operator had narrowed ran wider than
granted after every restart while the queue was unreachable, and in the
gap before the first 10 s poll. During the meta-repo import, every
non-ruth key is still unset, and the agent read that as the default too,
for as long as the import stayed pending.

mara picked option (a) on #5293: "a, removal of the old path as a follow
up in 1w".

hive-c0re now writes each agent's entry from
swarm-agent-permissions.json into the agent's runtime dir as
swarm-permissions.json (/run/hive in the container), together with
whether the import is still pending. It writes the file at every start
(write_dropins) and after every 30 s pass of the permissions worker. The
harness and the subagent daemon hold that stored list until their own
first read succeeds. While the import is pending, an unset key keeps
the stored list rather than reverting it to the default. A queue that
is down never blocks a start: the agent runs on the stored grant.

The decision lives in swarm_queue_client::agent_permissions::HiveCopy,
shared by both readers.

Part of #5170.

docs/agent-lifecycle/persistence.md

@@ -415,7 +415,9 @@ holds the permissions the swarm grants this hive's agents, as
 `workers::swarm_permissions` last read them from the swarm's
 `agent-permissions` bucket (every 30 seconds): a copy, not the
 record, which `swarmctl agent permissions` sets. `set_nspawn_flags`
-reads it at every container start for `manage_root_agent`.
+reads it at every container start for `manage_root_agent`. Each agent gets
+its own entry from it as `swarm-permissions.json` in its runtime dir, which
+it holds until its own first read of its key succeeds.
 
 hive-c0re renders containers onto `meta#<n>` at creation.
 

docs/process/conventions.md

@@ -302,10 +302,10 @@ the agent's key in the `agent-permissions` KV bucket
 (`swarm-queue-client/src/agent_permissions.rs`), which swarm-controller alone
 writes. Set them with `swarmctl agent permissions get|set|clear <agent>`
 (`/api/agents/{name}/permissions`), or on the swarm UI's create-agent screen
-(`permissions` in `POST /api/agents`). A missing key, an unset field, or no
-successful read yet means the default (`Permission::default_for`):
-`messaging`, `meta`, `inbox`, `execution`, plus `manage_root_agent` for
-`ruth`. `"permissions": []` grants none.
+(`permissions` in `POST /api/agents`). A missing key or an unset field means
+the default (`Permission::default_for`): `messaging`, `meta`, `inbox`,
+`execution`, plus `manage_root_agent` for `ruth`. `"permissions": []` grants
+none.
 
 **How a change applies** —
 - The agent's harness reads its own key every 10 seconds and builds every
@@ -319,6 +319,12 @@ successful read yet means the default (`Permission::default_for`):
   `/var/lib/hyperhive/swarm-agent-permissions.json`, outside the meta repo.
   nspawn fixes the bind mounts at container start, so when an agent's
   `manage_root_agent` changes hive-c0re restarts it after its current turn.
+- hive-c0re copies each agent's entry from that file into the agent's
+  runtime dir (`/run/hive/swarm-permissions.json` in the container) at every
+  start and after every 30-second pass, with whether the import below is
+  still pending. The harness and the subagent daemon hold that copy until
+  their own first read succeeds, so an agent whose queue is down starts on
+  its last stored grant, not the default.
 
 Every reader keeps its last good value on a failed read.
 
@@ -329,7 +335,8 @@ sends them to swarm-controller once as one list per agent (without
 only where there is none, and only for agents that hive's wanted state
 declares), and deletes
 both files from the meta repo when the controller answers
-(`workers/permissions_import.rs`). Until then it reads no keys.
+(`workers/permissions_import.rs`). Until then hive-c0re reads no keys, and an
+agent that reads its own key unset keeps the grant in its copy.
 
 **Not configurable from `agent.nix`** — that file changes through config PRs
 an agent can open, so letting it declare its own permissions would let an