fix: restrict WriteAgentStateFile to explicit filename allowlist

Addresses mara's security review: replace validate_state_filename (which
accepted any non-traversal filename) with a tight allowlist containing
only the two known credential filenames: forge-token and matrix-token.

Also addresses argus review feedback:
- drop issue tag from priv_proto.rs doc comment
- add comment explaining the path-detection heuristic in forge.rs
- add note about create_dir_all uid=0 edge case in write_agent_state_file

hive-c0re/src/forge.rs

@@ -302,6 +302,12 @@ async fn mint_and_persist_token(name: &str, path: &Path, scopes: &str) -> Result
     let token = mint_token(name, scopes).await?;
 
     // Agent state paths must go through hive-priv.
+    // Heuristic: any path containing an "agents" component is considered
+    // an agent state path (matches `/var/lib/hyperhive/agents/<name>/...`).
+    // All current callers pass either CORE_TOKEN_PATH (no "agents" component)
+    // or `token_path(name)` (under AGENT_STATE_ROOT which contains "agents").
+    // If a future non-agent path ever gains an "agents" component, this guard
+    // would incorrectly route it to priv — add an explicit exclusion then.
     if path.components().any(|c| c.as_os_str() == "agents") {
         let filename = path
             .file_name()