fix(#702): route container journal reads through hive-priv

The privsep drop to the hive-core user left four journalctl -M <container>
call sites shelling out directly. -M enters the container namespace via the
machine bus, which needs root, so all container-journal reads failed with
Permission denied. Add a ReadContainerJournal verb to hive-priv and route
dashboard get_journal, manager get_logs, the rebuild-failure journal tail,
and the agent host-journal -M path through it. Host-journal reads (no -M)
stay direct via systemd-journal group membership.

hive-c0re/src/lifecycle.rs

@@ -1195,14 +1195,24 @@ async fn priv_run(kind: &str, name: &str) -> Result<()> {
 /// or when the journal can't be read (machine gone, journalctl
 /// missing); it never produces an error of its own.
 async fn container_journal_tail(container: &str) -> String {
-    let out = Command::new("journalctl")
-        .args(["-M", container, "-n", "40", "--no-pager", "--output=short"])
-        .output()
-        .await;
-    match out {
-        Ok(o) if !o.stdout.is_empty() => format!(
+    // `-M` enters the container namespace and needs root, so the read
+    // is delegated to hive-priv (hive-c0re itself runs unprivileged).
+    let res = crate::priv_client::read_container_journal(
+        container,
+        40,
+        false,
+        hive_sh4re::priv_proto::JournalOutput::Short,
+        None,
+        None,
+        None,
+        None,
+        None,
+    )
+    .await;
+    match res {
+        Ok((stdout, _)) if !stdout.is_empty() => format!(
             "\n--- last 40 journal lines from container '{container}' ---\n{}",
-            String::from_utf8_lossy(&o.stdout).trim_end()
+            stdout.trim_end()
         ),
         _ => String::new(),
     }