priv: move shared consts to hive-sh4re; WriteNspawnFlags uses Vec<String> + per-flag validation

hive-sh4re/src/priv_proto.rs

@@ -8,6 +8,20 @@ use serde::{Deserialize, Serialize};
 /// Default socket path for the privileged helper.
 pub const PRIV_SOCK: &str = "/run/hive/priv.sock";
 
+/// Manager container name. Used by `hive-priv` to skip the `h-` prefix
+/// and by `hive-c0re` for identity checks.
+pub const MANAGER_NAME: &str = "root";
+
+/// Sub-agent container prefix. System container name = `h-<agent_name>`.
+pub const AGENT_PREFIX: &str = "h-";
+
+/// Sibling service containers managed by hive-c0re.
+pub const SIBLING_CONTAINERS: &[&str] = &["hive-forge", "hive-matrix", "hive-gateway"];
+
+/// Host path of the meta flake. The flake ref for agent `<name>` is
+/// `{META_DIR}#{name}`, derived by `hive-priv` — never passed over the wire.
+pub const META_DIR: &str = "/var/lib/hyperhive/meta";
+
 /// A request to the privileged helper.
 ///
 /// Wire format: one JSON object per line over `/run/hive/priv.sock`.
@@ -46,8 +60,9 @@ pub enum PrivRequest {
 
     /// Update `/etc/nixos-containers/<container>.conf`: strip network-isolation
     /// vars, force `PRIVATE_NETWORK=0`, and set `EXTRA_NSPAWN_FLAGS`.
-    /// Written by `lifecycle::set_nspawn_flags`.
-    WriteNspawnFlags { container: String, extra_nspawn_flags: String },
+    /// Each entry in `extra_nspawn_flags` is one flag (e.g. `"--bind=/path"`);
+    /// hive-priv validates and space-joins them. Written by `lifecycle::set_nspawn_flags`.
+    WriteNspawnFlags { container: String, extra_nspawn_flags: Vec<String> },
 
     /// Write `/run/systemd/system/container@<container>.service.d/hyperhive-limits.conf`
     /// with `[Service]\nMemoryMax=<memory_max>\nCPUQuota=<cpu_quota>\n`.