container stats: measure agent disk usage through hive-priv, unknown on failure

The disk sampler ran `du -sxb` as the unprivileged hive-core user over
each agent's state/, work/ and container rootfs. hive-core cannot read
the rootfs or all of the agent-owned files, so `du` failed and each
failed path silently counted as 0: the dashboard showed a few MB for
agents using over 13 GB.

Add a hive-priv `MeasureAgentDisk { agent_name }` op. hive-priv
validates the name, derives the three paths itself (the request carries
no path), skips the ones that don't exist, and runs one
`du -s -x -b -c -P` as root with a 10 min timeout. A timeout, a non-zero
exit or output without a `total` line is an error.

hive-c0re calls it every 30 min instead of running `du` every 5 min:
each pass walks every agent's full tree as root on the disk the agents
work on, and the sizes move slowly. A failed measurement is cached as
None, so `disk_bytes` is null, the OTel storage.usage sample is omitted
and the dashboard shows "unknown", never 0.

`Coordinator::agent_work_dir` had no other caller and is removed.

Closes #4956

docs/web-ui/dashboard.md

@@ -156,10 +156,12 @@ files read-only (world-readable; no `hive-priv`) and skips agents whose
 scope dir is absent (= not running). Pull-only: `core.js` polls every
 5 s **only while the C0NT41N3R L04D sub-tab is active** (CPU needs a fresh
 sample each refresh), and stops on sub-tab change. Disk size (`disk_bytes`)
-rides the same row, but a separate ~5 min background `du` sampler feeds
-it (`state/` + `work/` + container writable rootfs, shared nix store excluded via
-`du -x`), so the 5 s poll stays cheap cgroup-only reads; the row carries the
-last-sampled value (`null` until the first sample). Network isn't tracked
+rides the same row, but a separate background sampler feeds it every
+30 min: `hive-priv` runs one bounded `du -x` as root over the agent's
+`state/` + `work/` + container writable rootfs (shared nix store excluded),
+so the 5 s poll stays cheap cgroup-only reads. The row carries the last
+measured value; the column shows "unknown" (`null`) before the first
+measurement and whenever the last one failed, never 0. Network isn't tracked
 per container — see `docs/networking/network.md` for the current
 per-agent netns model.
 
@@ -922,9 +924,10 @@ below — some endpoints aren't in it yet.
   ~200 ms so the call briefly awaits. Skips non-running agents (no scope
   dir). No network field — agents share the host netns. `disk_bytes` is
   the last value from a **separate slow sampler** (not this hot path):
-  a background `du -sxb` of the agent's `state/` + `work/` + container writable
-  rootfs every ~5 min, `-x` excluding the shared read-only nix store.
-  `null` until the first sample lands.
+  every 30 min `hive-priv` runs a bounded `du -sxb` as root over the agent's
+  `state/` + `work/` + container writable rootfs, `-x` excluding the shared
+  read-only nix store (`PrivRequest::MeasureAgentDisk`). `null` means
+  unknown: not measured yet, or the last measurement failed.
 - `POST /api/cancel-reminder/{id}` — hard-delete a pending reminder.
 - `POST /api/retry-reminder/{id}` — re-arm a reminder whose delivery
   failed (clears the failure state so the scheduler retries).