download an agent's cached closure in prebuild, building locally when that fails

hive-priv/src/container.rs

@@ -245,7 +245,7 @@ fn toplevel_attr(flake: &str, name: &str) -> String {
 const NIX_BUILD_TIMEOUT: std::time::Duration = std::time::Duration::from_hours(1);
 
 /// How a [`run_bounded`] child ended.
-enum BoundedRun {
+pub(crate) enum BoundedRun {
     Exited {
         status: std::process::ExitStatus,
         stdout: String,
@@ -262,7 +262,7 @@ enum BoundedRun {
 /// The child leads its own process group and a timeout `SIGKILL`s the whole
 /// group, so a grandchild still holding the pipes (or the daemon connection)
 /// dies with it instead of outliving the error.
-async fn run_bounded(
+pub(crate) async fn run_bounded(
     mut cmd: Command,
     limit: std::time::Duration,
     mut writer: Option<&mut OwnedWriteHalf>,