run opted-in agents in a user namespace with a dedicated data owner

nix/module-eval/core-toggle.nix

@@ -137,6 +137,58 @@ let
   remainsAfterExit = u: u.serviceConfig.RemainAfterExit or false;
 
   cases = [
+    {
+      # The control is the default on a host that defines the ids below:
+      # it gets past every arm, so each refusal is the arm's own.
+      name = "the userns data owner is refused where it collides with a host id or a reserved range";
+      ok =
+        let
+          problems =
+            owner:
+            import ../host-modules/lib/userns-data-owner.nix { inherit lib; } {
+              inherit owner;
+              uids = [
+                0
+                60001
+              ];
+              gids = [
+                100
+                60002
+              ];
+            };
+        in
+        problems 60000 == [ ]
+        &&
+          map (o: builtins.length (problems o)) [
+            1000
+            29999
+            61184
+            65534
+            60001
+            60002
+          ] == [
+            1
+            1
+            1
+            1
+            1
+            1
+          ];
+    }
+    {
+      # Read back from the rendered unit and assertion list: a misspelt
+      # variable or a dropped assertion fails here.
+      name = "hive-priv carries the userns agents and data owner, and the owner assertion passes";
+      ok =
+        let
+          e = allLocal.systemd.services.hive-priv.environment;
+        in
+        e.HIVE_PRIV_USERNS_AGENTS == ""
+        && e.HIVE_PRIV_USERNS_DATA_OWNER == "60000"
+        && lib.any (
+          a: lib.hasPrefix "services.hyperhive.userns.dataOwner" a.message && a.assertion
+        ) allLocal.assertions;
+    }
     {
       # The domain is the stub's swarm domain, which both fixtures share.
       name = "the forge's publicUrl default does not consult the central toggle";