feat(#2302): thread &Ident through agent path builders

hive-c0re/src/matrix.rs

@@ -65,7 +65,7 @@ pub fn admin_token_path() -> PathBuf {
 
 /// Token file inside the agent's bind-mounted state dir (visible as
 /// `/state/matrix-token` from inside the container).
-fn token_path(name: &str) -> PathBuf {
+fn token_path(name: &hive_host_sock::Ident) -> PathBuf {
     Coordinator::agent_notes_dir(name).join("matrix-token")
 }
 
@@ -89,7 +89,7 @@ fn password_path(name: &str) -> PathBuf {
 /// move credentials from old deployments to the new location. Safe to
 /// call after `destroy --purge` — the path will simply not exist and
 /// the migration is a no-op.
-fn legacy_password_path(name: &str) -> PathBuf {
+fn legacy_password_path(name: &hive_host_sock::Ident) -> PathBuf {
     Coordinator::agent_notes_dir(name).join("matrix-password")
 }
 
@@ -611,7 +611,9 @@ pub async fn ensure_user_for(
     register_token: &str,
 ) -> Result<()> {
     use std::os::unix::fs::PermissionsExt;
-    let path = token_path(name);
+    let agent = hive_host_sock::Ident::parse(name)
+        .map_err(|e| anyhow::anyhow!("invalid agent name {name:?}: {e}"))?;
+    let path = token_path(&agent);
     if path.exists()
         && let Ok(existing) = std::fs::read_to_string(&path)
         && !existing.trim().is_empty()
@@ -623,7 +625,7 @@ pub async fn ensure_user_for(
     // One-time migration: move the password from the old location inside
     // agent_notes_dir (purgeable) to the new location outside it.
     let new_pw_path = password_path(name);
-    let old_pw_path = legacy_password_path(name);
+    let old_pw_path = legacy_password_path(&agent);
     if !new_pw_path.exists() && old_pw_path.exists() {
         if let Some(parent) = new_pw_path.parent() {
             std::fs::create_dir_all(parent).ok();