fix(#702): route container journal reads through hive-priv

The privsep drop to the hive-core user left four journalctl -M <container>
call sites shelling out directly. -M enters the container namespace via the
machine bus, which needs root, so all container-journal reads failed with
Permission denied. Add a ReadContainerJournal verb to hive-priv and route
dashboard get_journal, manager get_logs, the rebuild-failure journal tail,
and the agent host-journal -M path through it. Host-journal reads (no -M)
stay direct via systemd-journal group membership.

hive-c0re/src/manager_server.rs

@@ -254,31 +254,28 @@ async fn dispatch(req: &ManagerRequest, coord: &Arc<Coordinator>) -> ManagerResp
             let n = lines.unwrap_or(50);
             // `journalctl -M` wants the container name (`h-<name>`),
             // not the logical agent name. `container_name` adds the prefix.
+            // The `-M` read needs root, so it goes through hive-priv.
             let machine = crate::lifecycle::container_name(agent);
             tracing::info!(%agent, %machine, %n, "manager: get_logs");
-            match tokio::process::Command::new("journalctl")
-                .args([
-                    "-M",
-                    &machine,
-                    "-n",
-                    &n.to_string(),
-                    "--no-pager",
-                    "--output=short",
-                ])
-                .output()
-                .await
+            match crate::priv_client::read_container_journal(
+                &machine,
+                n,
+                false,
+                hive_sh4re::priv_proto::JournalOutput::Short,
+                None,
+                None,
+                None,
+                None,
+                None,
+            )
+            .await
             {
-                Ok(out) => {
-                    let content = if out.status.success() || !out.stdout.is_empty() {
-                        String::from_utf8_lossy(&out.stdout).into_owned()
-                    } else {
-                        let stderr = String::from_utf8_lossy(&out.stderr);
-                        format!("journalctl exited {}: {stderr}", out.status)
-                    };
+                Ok((stdout, stderr)) => {
+                    let content = if !stdout.is_empty() { stdout } else { stderr };
                     ManagerResponse::Logs { content }
                 }
                 Err(e) => ManagerResponse::Err {
-                    message: format!("journalctl spawn failed: {e:#}"),
+                    message: format!("get_logs: {e:#}"),
                 },
             }
         }