fix(#1013): make write private — only set_groups and remove_agent are the write paths

hive-c0re/src/tool_groups.rs

@@ -56,10 +56,9 @@ pub fn groups_for(name: &str) -> Vec<String> {
 }
 
 /// Persist the full tool-groups map. Sorted JSON output keeps diffs
-/// minimal. Best-effort — returns `io::Error` so callers decide
-/// whether to abort or log. Prefer `set_groups` over calling this
-/// directly — `set_groups` validates group names before writing.
-pub fn write(map: &BTreeMap<String, Vec<String>>) -> std::io::Result<()> {
+/// minimal. Use `set_groups` (or `remove_agent`) from outside this
+/// module — they go through the validated write path.
+fn write(map: &BTreeMap<String, Vec<String>>) -> std::io::Result<()> {
     let path = tool_groups_path();
     if let Some(parent) = path.parent() {
         std::fs::create_dir_all(parent)?;