agents: work/ in the disk-metric docs, holder never sees work/, chown guard comment

hive-c0re/src/lifecycle/host_config.rs

@@ -148,7 +148,7 @@ fn config_bind_source(name: &str) -> PathBuf {
 /// The only caller left is the `ManageRootAgent` grant; the parent/child
 /// tree that handed every agent its own children here is gone.
 ///
-/// **Three dirs, three different answers** — the uniformity of the
+/// **Four dirs, three different answers** — the uniformity of the
 /// original loop is what hid that:
 ///
 /// - `state` is **read-write**: the holder reads and writes another
@@ -164,6 +164,9 @@ fn config_bind_source(name: &str) -> PathBuf {
 ///   which the holder has a stated reason to read, let alone write.
 ///   hive-c0re still reads it directly on the host (`stats::hive_stats`),
 ///   which needs no bind mount into anyone else's container.
+/// - `work` is **absent entirely**, like `harness`. It is the agent's own
+///   worktrees and build trees, often very large, and nothing gives the
+///   holder a reason to see it.
 ///
 /// ⚠️ The config-repo seeding hive-c0re does at spawn is **not** affected by
 /// the `config` flag and must not be read as a reason to widen it: that runs
@@ -567,6 +570,24 @@ mod tests {
         assert!(work_dir.is_dir());
     }
 
+    /// `work` holds the agent's worktrees and build trees; like `harness` it
+    /// is never bound into another agent's container.
+    #[test]
+    fn a_holder_never_sees_another_agents_work_dir() {
+        for bind in child_binds() {
+            assert!(
+                !bind.container_path.contains("work"),
+                "another agent's work dir must not be bound in: {}",
+                bind.container_path
+            );
+            assert!(
+                !bind.host_path.ends_with("/work"),
+                "another agent's work dir must not be bound in: {}",
+                bind.host_path
+            );
+        }
+    }
+
     /// An unparseable name yields no mounts at all — the guard must fail
     /// closed, since the alternative is a path built from unvalidated
     /// input.