fix(#2290): reset-failed before nixos-container start in hive-priv

systemd will refuse to start a unit that has hit start-limit. nixos-
container start does not clear the counter first. Add a best-effort
  systemctl reset-failed container@h-<name>.service
before each StartContainer so an earlier lockout cannot block a now-
correct start. Ignoring the reset exit code is intentional: the unit
may not exist yet on first-time create, and reset-failed on a clean
unit is a harmless no-op.

hive-priv/src/main.rs

@@ -162,7 +162,16 @@ async fn exec(req: PrivRequest, writer: &mut OwnedWriteHalf) -> Result<(String,
     match req {
         PrivRequest::StartContainer { ref name } => {
             validate_container_name(name)?;
-            container_run(&["start", &container_system_name(name)]).await
+            let machine = container_system_name(name);
+            // Clear any start-limit lockout left by earlier failures so a
+            // now-correct start isn't blocked. nixos-container start does not
+            // do this itself. Best-effort: if the unit doesn't exist yet
+            // (first-time create) reset-failed is a no-op and we proceed.
+            let _ = Command::new("systemctl")
+                .args(["reset-failed", &format!("container@{machine}.service")])
+                .status()
+                .await;
+            container_run(&["start", &machine]).await
         }
 
         PrivRequest::StopContainer { ref name } => {