harness: write claude configs to systemd RuntimeDirectory + chown ~/.claude on activation (#658 fixup)

hive-ag3nt/src/paths.rs

@@ -23,6 +23,22 @@ pub fn state_dir() -> PathBuf {
     PathBuf::from(format!("/agents/{label}/state"))
 }
 
+/// Per-turn config dir for the regenerated claude-{mcp-config,settings,
+/// system-prompt} files the harness drops before each turn. Set by
+/// systemd via `RuntimeDirectory = "hive-config"` (#658 fixup): a
+/// per-service runtime dir owned by the agent unix user, auto-cleared
+/// on stop. Kept separate from `/run/hive` (the host-owned mcp.sock
+/// bind) so the harness owns its own write surface and we don't have
+/// to chown a bind-mounted dir. Overridable via `HYPERHIVE_CONFIG_DIR`
+/// for dev / test scenarios.
+#[must_use]
+pub fn config_dir() -> PathBuf {
+    if let Some(p) = std::env::var_os("HYPERHIVE_CONFIG_DIR") {
+        return PathBuf::from(p);
+    }
+    PathBuf::from("/run/hive-config")
+}
+
 /// Claude credentials directory for the current agent. `$HOME/.claude`
 /// matches what the `claude` CLI reads at runtime — both binaries see
 /// the same `$HOME` set by the per-service systemd `environment`