agents: persistent /agents/<n>/work dir outside state/

Agents keep git worktrees and cargo target dirs under /home/<agent>,
which lives in the container rootfs and is deleted on destroy. They
can't move them under state/, because a claude started there walks up
into state/CLAUDE.md and takes on the agent's identity.

Add a per-agent work/ dir next to state/ on the host
(/var/lib/hyperhive/agents/<n>/work), bind-mounted RW at
/agents/<n>/work. hive-c0re creates it in ensure_state_dir and in
set_nspawn_flags (the rebuild path reaches only the latter), the
agent's activation chowns it to the agent user like state/ and
harness/, and measure_agent_disk counts it. destroy never touches the
agent root, so work/ survives it; purge removes the whole root, so
work/ goes with it.

Closes #4977

docs/agent-lifecycle/persistence.md

@@ -314,6 +314,15 @@ Under `/var/lib/hyperhive/agents/<name>/`:
   - `hyperhive-events.sqlite` — turn-loop event log.
   - `hyperhive-turn-stats.sqlite` — per-turn timing stats.
   - `hyperhive-model` — single-line model name override file.
+- `work/` — the agent's working space for git worktrees, build dirs
+  and other large working data. Bind-mounted RW to
+  `/agents/<name>/work` inside the container and owned by the agent
+  user. It sits outside `state/` so a claude or subagent started under
+  `work/` doesn't walk up into `state/CLAUDE.md` and load the agent's
+  own identity. Survives `destroy`/recreate, gone on `--purge`. Counted
+  in the per-agent disk metric (`measure_agent_disk`) together with
+  `state/` and the container rootfs. The dashboard doesn't serve it:
+  the state-file endpoint reads `state/` only.
 
 ### Cross-agent access to state