wait for hive-priv's reply to a daemon-reload in the link-refusal subtest

nix/vm-tests/agent-ephemeral-rootfs.nix

@@ -241,8 +241,12 @@ pkgs.testers.runNixOSTest {
             {"op": "write_resource_limits", "container": MACHINE, "memory_max": "1G", "cpu_quota": "200%"},
             {"op": "daemon_reload"},
         ]:
-            out = host.succeed(f"echo '{json.dumps(req)}' | socat - UNIX-CONNECT:/run/hive/priv.sock")
-            assert json.loads(out.strip().splitlines()[-1])["ok"] is True, out
+            # socat gives up 0.5s after its stdin ends unless told to wait, and
+            # a daemon-reload answers later than that.
+            out = host.succeed(f"echo '{json.dumps(req)}' | socat -t 30 - UNIX-CONNECT:/run/hive/priv.sock")
+            lines = out.strip().splitlines()
+            assert lines, f"hive-priv sent no response to {req['op']}; journal:\n{priv_journal()}"
+            assert json.loads(lines[-1])["ok"] is True, f"response={out!r}; journal:\n{priv_journal()}"
         dropin = host.succeed(f"cat /run/systemd/system/container@{MACHINE}.service.d/hyperhive-limits.conf")
         assert "ExecStartPre=/nix/store/" in dropin and f"check-rootfs {MACHINE}\n" in dropin, dropin
         # The build the drop-in names is rooted against garbage collection.