hive-c0re: agent_sockets.json writer (#784 phase 2, step 2a)

sibling to agent_ports.rs (#748 / #15). Writes
/var/lib/hyperhive/agent-sockets.json mapping agent name → unix
socket path under /run/hive-agent/<name>.sock — the source of truth
for the gateway's eventual unix-socket upstreams once it flips off
TCP per #784's transition plan.

shape mirrors agent_ports.rs:
- BTreeMap for deterministic JSON output
- atomic <path>.tmp + rename for partial-write safety
- idempotent (skip rewrite when content unchanged)
- MANAGER_NAME filter (gateway routes manager via dashboard upstream,
  not /agent/<n>/)

socket_path_for(name) is pure-deterministic so a name alone resolves
to the same path the c0re writes + the harness binds via
HIVE_WEB_SOCKET (post-PR #800).

hooked into meta::sync_agents alongside the existing
agent_ports::write call (same best-effort + non-fatal shape).

next: step 2b (lifecycle bind-mount /run/hive-agent/ into agent +
gateway containers, with per-agent isolation per mara's #800 nudge
'agents can only access their own sockets'). then atlas's step 3
(gateway proxy_pass http://unix:...). then step 4 drops TCP.

hive-c0re/src/meta.rs

@@ -115,6 +115,16 @@ pub async fn sync_agents(
         tracing::warn!(error = ?e, "agent_ports::write failed (non-fatal)");
     }
 
+    // Refresh /var/lib/hyperhive/agent-sockets.json — sibling to the
+    // ports map, drives the gateway's unix-socket upstreams once
+    // agents opt in to `HIVE_WEB_SOCKET` (PR #800 / #784 phase 1).
+    // Coexists with the TCP-port map during the transition: the
+    // gateway picks the socket upstream when one exists, falls back
+    // to the TCP port otherwise. Same best-effort + non-fatal shape.
+    if let Err(e) = crate::agent_sockets::write(&agent_names) {
+        tracing::warn!(error = ?e, "agent_sockets::write failed (non-fatal)");
+    }
+
     if initial {
         git(&dir, &["init", "--initial-branch=main"]).await?;
     }