feat(#2290): maintain /etc/tmpfiles.d/hyperhive-agents.conf for boot safety

Root cause of the boot outage: container@h-* units try to start before
hive-c0re reaches ensure_runtime, so bind-mount source dirs are missing.

Fix: hive-c0re (via hive-priv, which runs as root) writes
/etc/tmpfiles.d/hyperhive-agents.conf whenever the agent set changes.
systemd-tmpfiles-setup.service (sysinit.target) reads it at every boot
BEFORE any container units start, pre-creating:

  /run/hyperhive/agents/<name>  — MCP socket dir (bind -> /run/hive)
  /run/hive-agent/<name>        — web socket dir (bind -> /run/hive-agent)

This alone removes the outage class: even if hive-c0re is slow to start,
the bind-mount sources exist and container units can activate.

Added:
- PrivRequest::SyncAgentTmpfiles { agents } in hive-sh4re
- sync_agent_tmpfiles() in hive-priv: generates content, writes atomically,
  calls systemd-tmpfiles --create to apply immediately
- priv_client::sync_agent_tmpfiles() wrapper
- lifecycle::sync_tmpfiles() best-effort helper (list + priv call)
- Call sites: hive-c0re startup, handle_spawn success, destroy success

hive-c0re/src/main.rs

@@ -283,6 +283,12 @@ async fn cmd_serve(
     if let Err(e) = auto_update::ensure_root_agent(&coord).await {
         tracing::warn!(error = ?e, "auto-spawn root agent failed");
     }
+    // Sync /etc/tmpfiles.d/hyperhive-agents.conf so agent runtime dirs are
+    // pre-declared for the next boot. Best-effort background task — a failure
+    // here must not block hive-c0re startup. See lifecycle::sync_tmpfiles.
+    tokio::spawn(async {
+        hive_c0re::lifecycle::sync_tmpfiles().await;
+    });
     // Auto-update in the background — don't block service start.
     // Sub-agent rebuilds can take tens of seconds; we want the admin
     // socket up immediately.