agent permissions: hold hive-c0re's stored grant until the agent's own read

Until its first successful read of its key, the harness read its
permissions as the default set, `execution` included. So did the
subagent daemon. An agent the operator had narrowed ran wider than
granted after every restart while the queue was unreachable, and in the
gap before the first 10 s poll. During the meta-repo import, every
non-ruth key is still unset, and the agent read that as the default too,
for as long as the import stayed pending.

mara picked option (a) on #5293: "a, removal of the old path as a follow
up in 1w".

hive-c0re now writes each agent's entry from
swarm-agent-permissions.json into the agent's runtime dir as
swarm-permissions.json (/run/hive in the container), together with
whether the import is still pending. It writes the file at every start
(write_dropins) and after every 30 s pass of the permissions worker. The
harness and the subagent daemon hold that stored list until their own
first read succeeds. While the import is pending, an unset key keeps
the stored list rather than reverting it to the default. A queue that
is down never blocks a start: the agent runs on the stored grant.

The decision lives in swarm_queue_client::agent_permissions::HiveCopy,
shared by both readers.

Part of #5170.

hive-c0re/src/workers/permissions_import.rs

@@ -137,6 +137,13 @@ fn meta_dir() -> PathBuf {
     crate::paths::meta_root()
 }
 
+/// Whether a meta repo file is still waiting to be imported.
+#[must_use]
+pub fn pending() -> bool {
+    let meta = meta_dir();
+    META_FILES.iter().any(|f| meta.join(f).exists())
+}
+
 /// Store the files' grants as the last-read swarm permissions, when a file
 /// is still there and nothing has been stored yet.
 pub fn seed_local() {

hive-c0re/src/workers/swarm_permissions.rs

@@ -6,7 +6,9 @@
 //! [`crate::permissions`], where the container's bind mounts are worked out.
 //! Those are fixed when the container starts, so an agent whose
 //! `manage_root_agent` changed is restarted, after its current turn. The
-//! agent applies the rest of its permissions itself.
+//! agent applies the rest of its permissions itself; after every pass each
+//! agent's copy of its stored entry is refreshed
+//! ([`crate::permissions::hand_at`]), which it holds until it reads its key.
 //!
 //! A failed read, or a bucket that does not answer, leaves the stored
 //! permissions as they are and restarts nothing.
@@ -68,6 +70,7 @@ pub async fn follow(
                 });
             }
         }
+        hand_all().await;
         tokio::select! {
             () = tokio::time::sleep(READ_INTERVAL) => {}
             _ = shutdown.changed() => {
@@ -132,6 +135,24 @@ where
         .collect())
 }
 
+/// Refresh the copy of its stored permissions each agent with a runtime dir
+/// holds, so it follows this pass's reads and the import's progress.
+async fn hand_all() {
+    let agents = match crate::lifecycle::agents_for_meta_listing().await {
+        Ok(agents) => agents,
+        Err(e) => {
+            tracing::warn!(error = ?e, "swarm permissions: enumerating agents to hand their copies failed");
+            return;
+        }
+    };
+    for spec in agents {
+        let dir = crate::paths::agent_runtime_dir(&spec.name);
+        if dir.is_dir() {
+            crate::lifecycle::hand_permissions(&spec.name, &dir);
+        }
+    }
+}
+
 /// Whether `agent` holds the one permission hive-c0re enforces under `stored`.
 fn manages(agent: &str, stored: &Stored) -> bool {
     permissions::effective(agent, stored.get(agent)).contains(&Permission::ManageRootAgent)