harness: write claude configs to systemd RuntimeDirectory + chown ~/.claude on activation (#658 fixup)

nix/templates/agent-base.nix

@@ -38,14 +38,14 @@ in
       ExecStart = "${pkgs.hyperhive}/bin/hive-ag3nt serve";
       Restart = "on-failure";
       RestartSec = 2;
-      # `/run/hive` is bind-mounted from the host root-owned 0755
-      # (hive-c0re's `set_nspawn_flags`). Post-#658 the harness
-      # runs as the per-agent user and needs to drop mcp.sock +
-      # claude-{mcp-config,settings,system-prompt} files there.
-      # `+` runs ExecStartPre as root (before the User= drop) so
-      # we can chown the bind onto the agent user every start —
-      # robust against activation-script timing on first boot.
-      ExecStartPre = "+${pkgs.coreutils}/bin/chown -R ${userName}:${userName} /run/hive";
+      # `/run/hive-config/` is a per-service runtime dir owned by
+      # the agent user (`User=` below), auto-cleared by systemd on
+      # stop. The harness writes its regenerated
+      # claude-{mcp-config,settings,system-prompt} files there
+      # (see `paths::config_dir`). Kept separate from `/run/hive`
+      # — that bind comes in root-owned from the host and holds
+      # hive-c0re's `mcp.sock` we only connect to (#658 fixup).
+      RuntimeDirectory = "hive-config";
       # Run the harness as the per-agent user (#658). claude itself
       # spawned by the harness then runs as that user too — drops
       # root inside the container while sudo (`NOPASSWD: ALL` by