agents: work/ in the disk-metric docs, holder never sees work/, chown guard comment

hive-c0re/src/stats/container_stats.rs

@@ -57,7 +57,7 @@ pub struct ContainerResource {
     /// Memory ceiling (`memory.max`), bytes. `None` when unlimited
     /// (the file reads `max`).
     pub mem_max_bytes: Option<u64>,
-    /// Last-sampled total disk usage — the agent's state dir plus the
+    /// Last-sampled total disk usage — the agent's `state/` and `work/` dirs plus the
     /// container's writable rootfs, excluding the shared read-only nix
     /// store — in bytes. `None` until the slow background sampler
     /// ([`disk_sampler_loop`]) has populated the cache at least once.