check the container root before each start

docs/agent-lifecycle/persistence.md

@@ -382,6 +382,32 @@ first. A failed salvage leaves the root where it was and the container starts
 without the flag (hive-priv logs the error), so a failure costs the switch,
 never data.
 
+**Checked before every start.** nixpkgs' start script runs as host root on
+the root template, and its `mkdir -p`, `chmod`, `touch` and
+`cp --remove-destination` follow a link the container planted at the paths
+they touch. The container's limits drop-in
+(`container@h-<name>.service.d/hyperhive-limits.conf`) therefore carries an
+`ExecStartPre=` that runs `hive-priv check-rootfs h-<name>` ahead of that
+script, on systemd's own restarts too. It looks at each path with `lstat`,
+never following a link, and fails the start with one line on stderr naming the
+path and its type when:
+
+- `usr`, `usr/bin`, `etc`, `var`, `var/lib`, `var/lib/private` or `root`
+  exists and isn't a real directory;
+- `etc/machine-id` or `etc/resolv.conf` exists and isn't a regular file
+  (`etc/os-release` may also be a link, which the script skips and a booted
+  NixOS guest creates);
+- the profile's `system` (`/nix/var/nix/profiles/per-container/h-<name>/system`)
+  exists and isn't a link that resolves into `/nix/store`, or the `system`
+  file inside the resolved directory isn't a regular file.
+
+Absent paths pass, so a first start works. The check neither deletes nor
+repairs: the operator removes the offending entry, and the next start goes
+through.
+The drop-in names the `hive-priv` binary that wrote it, so a drop-in never
+points at a build without the sub-command. A drop-in written by an older
+hive-priv has no `ExecStartPre=` and the container starts as before.
+
 The journal still ships. The agent's collector (`nix/agent-modules/otel.nix`)
 reads the guest's own `/var/log/journal` and pushes it over OTLP, so no
 journal link to the host takes part; nspawn skips `--link-journal=try-guest`