harness: write claude configs to systemd RuntimeDirectory + chown ~/.claude on activation (#658 fixup)

nix/templates/harness-base.nix

@@ -687,6 +687,18 @@ in
         [ -d "$stateDir" ] || continue
         chown -hR "$userName:$userName" "$stateDir" 2>/dev/null || true
       done
+      # Same treatment for the bind-mounted `~/.claude/` dir. Pre-#658
+      # the harness ran as root and `claude` wrote `.credentials.json`
+      # there 0600 root:root; post-#658 the harness reads
+      # `~/.claude/` as the agent user to decide Online vs
+      # NeedsLogin (`login::has_session`), and the host-side bind
+      # source is still root-owned 0700 from those legacy writes.
+      # Chown recursively so the existing credentials are readable
+      # under the new identity instead of getting silently treated
+      # as "no session" and re-prompting login every boot.
+      if [ -d "$homeDir/.claude" ]; then
+        chown -hR "$userName:$userName" "$homeDir/.claude" 2>/dev/null || true
+      fi
     '';
 
     # Auto-inject the matrix MCP entry when matrix is enabled (#548