agent UDS: chmod per-agent socket dir 0777 + log web_ui::serve errors

The harness runs as the non-root agent user; the per-agent
/run/hive-agent/<name>/ dir lands at 0755 root:root after
create_dir_all, so bind(2) of web.sock failed with EACCES. The error
was invisible because the web_ui::serve future was tokio::spawn'd with
its JoinHandle dropped — no log, no socket, agent looks unreachable
through the gateway.

hive-ag3nt/src/bin/hive.rs

@@ -564,15 +564,29 @@ async fn serve_main<S: Surface>(socket: &Path, poll_ms: u64) -> Result<()> {
         socket.to_path_buf(),
         S::FORGE_IS_MANAGER,
     ));
-    tokio::spawn(web_ui::serve(
-        label,
+    // Log web_ui::serve's error instead of dropping it. A bare
+    // `tokio::spawn(web_ui::serve(...))` discards the JoinHandle, so
+    // any Err (e.g. EACCES from `bind_unix` when HIVE_WEB_SOCKET points
+    // at a dir the agent user can't write) vanishes — leaving an
+    // operator with no log line and no socket, debuggable only by
+    // staring at lifecycle.rs.
+    let web_ui_args = (
+        label.clone(),
         port,
         login_state.clone(),
         bus.clone(),
         socket.to_path_buf(),
         files.clone(),
         turn_lock.clone(),
-    ));
+    );
+    tokio::spawn(async move {
+        let (label, port, login_state, bus, socket, files, turn_lock) = web_ui_args;
+        if let Err(e) =
+            web_ui::serve(label, port, login_state, bus, socket, files, turn_lock).await
+        {
+            tracing::error!(error = %e, "web_ui::serve exited with error");
+        }
+    });
     if matches!(initial, LoginState::NeedsLogin) {
         turn::wait_for_login(&claude_dir, login_state.clone(), &bus, poll_ms).await;
     } else {