hive-c0re: fail on an unparseable permission file, write it atomically

tool_groups::read and capabilities::read returned an empty map when
their file existed but didn't parse. Every set_*/remove_agent is a
read-modify-write, and write() rewrote the file in place, so a crash or
ENOSPC mid-write left a truncated file, and the next write (e.g. the
manager-spawn seed of ruth's tool groups) replaced it with a map holding
only one agent. The scheduling and approval gates then denied every
other agent, recoverable only from meta git history.

- Both registries now read through agent_config::read_map: a missing
  file is still the empty map, any other read failure or a parse
  failure is an io::Error. set_groups / set_caps / remove_agent fail
  without writing.
- Writes go through agent_config::write_map: temp file in the same
  directory, fsync, rename, fsync the directory. hive-c0re had no
  shared atomic-write helper (the existing tmp+rename sites are inline
  and don't fsync).
- Callers of read / groups_for / has_cap now handle the error:
  * dashboard GET /api/tool-groups, /api/capabilities,
    /api/permissions/stale return 500 instead of an empty table;
  * the SSE permission snapshots are skipped with a warn;
  * render_flake returns Result, so sync_agents fails instead of
    rendering every agent without its tool groups / capabilities;
  * set_nspawn_flags propagates has_cap's error;
  * the socket tool-group gates deny with the read error as message;
  * seed_manager_tool_groups logs and does not seed.
- capabilities::write had no callers left once set_caps writes through
  write_map, and is removed.

Closes #4719

hive-c0re/src/agent_config/tool_groups.rs

@@ -22,7 +22,7 @@
 //! that the operator uses to grant/revoke tool groups per agent.
 
 use std::collections::BTreeMap;
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 
 use anyhow::Context as _;
 
@@ -33,37 +33,18 @@ pub fn tool_groups_path() -> PathBuf {
     crate::paths::meta_root().join(TOOL_GROUPS_FILE)
 }
 
-/// Read the per-agent tool-group map. Returns an empty map when the
-/// file is absent or unparsable — callers treat a missing entry as
-/// "use role default".
-#[must_use]
-pub fn read() -> BTreeMap<String, Vec<String>> {
-    let path = tool_groups_path();
-    let Ok(raw) = std::fs::read_to_string(&path) else {
-        return BTreeMap::new();
-    };
-    serde_json::from_str(&raw).unwrap_or_default()
+/// Read the per-agent tool-group map. An absent file is the empty map —
+/// callers treat a missing entry as "use role default". A file that
+/// exists but can't be read or parsed is an error.
+pub fn read() -> std::io::Result<BTreeMap<String, Vec<String>>> {
+    super::read_map(&tool_groups_path())
 }
 
 /// Look up the configured tool groups for one agent. Returns an empty
 /// vec when the agent has no entry — callers should treat this as
-/// "use the harness role default."
-#[must_use]
-pub fn groups_for(name: &str) -> Vec<String> {
-    read().get(name).cloned().unwrap_or_default()
-}
-
-/// Persist the full tool-groups map. Sorted JSON output keeps diffs
-/// minimal. Use `set_groups` (or `remove_agent`) from outside this
-/// module — they go through the validated write path.
-fn write(map: &BTreeMap<String, Vec<String>>) -> std::io::Result<()> {
-    let path = tool_groups_path();
-    if let Some(parent) = path.parent() {
-        std::fs::create_dir_all(parent)?;
-    }
-    let text = serde_json::to_string_pretty(map)
-        .map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidData, e))?;
-    std::fs::write(&path, format!("{text}\n"))
+/// "use the harness role default." Errors as [`read`] does.
+pub fn groups_for(name: &str) -> std::io::Result<Vec<String>> {
+    Ok(read()?.get(name).cloned().unwrap_or_default())
 }
 
 /// Validate a slice of group name strings against `ToolGroup::ALL`.
@@ -96,25 +77,76 @@ pub fn validate_groups(groups: &[String]) -> anyhow::Result<()> {
 
 /// Set the tool groups for one agent and persist the map. An empty
 /// `groups` vec removes the entry (agent reverts to role default).
-/// Returns an error if any name is not in `ToolGroup::ALL`.
+/// Returns an error if any name is not in `ToolGroup::ALL`, or if the
+/// existing file can't be read or parsed — the file is then left
+/// untouched.
 pub fn set_groups(name: &str, groups: &[String]) -> anyhow::Result<()> {
+    set_groups_at(&tool_groups_path(), name, groups)
+}
+
+fn set_groups_at(path: &Path, name: &str, groups: &[String]) -> anyhow::Result<()> {
     if !groups.is_empty() {
         validate_groups(groups)?;
     }
-    let mut current = read();
+    let mut current = super::read_map(path)?;
     if groups.is_empty() {
         current.remove(name);
     } else {
         current.insert(name.to_owned(), groups.to_vec());
     }
-    write(&current).with_context(|| format!("write tool-groups for {name}"))
+    super::write_map(path, &current).with_context(|| format!("write tool-groups for {name}"))
 }
 
 /// Drop the entry for an agent that is being destroyed. Idempotent.
+/// Fails without writing if the existing file can't be read or parsed.
 pub fn remove_agent(name: &str) -> std::io::Result<()> {
-    let mut current = read();
+    remove_agent_at(&tool_groups_path(), name)
+}
+
+fn remove_agent_at(path: &Path, name: &str) -> std::io::Result<()> {
+    let mut current = super::read_map(path)?;
     if current.remove(name).is_some() {
-        write(&current)?;
+        super::write_map(path, &current)?;
     }
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const TRUNCATED: &str = "{\n  \"alice\": [\"messaging\", \"meta\"],\n  \"bob\": [\"mess";
+
+    fn corrupt_file() -> (tempfile::TempDir, PathBuf) {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join(TOOL_GROUPS_FILE);
+        std::fs::write(&path, TRUNCATED).expect("seed");
+        (dir, path)
+    }
+
+    #[test]
+    fn set_groups_leaves_a_corrupt_file_untouched() {
+        let (_dir, path) = corrupt_file();
+        set_groups_at(&path, "ruth", &["messaging".to_owned()])
+            .expect_err("a corrupt file must not be overwritten");
+        assert_eq!(std::fs::read(&path).expect("read"), TRUNCATED.as_bytes());
+    }
+
+    #[test]
+    fn remove_agent_leaves_a_corrupt_file_untouched() {
+        let (_dir, path) = corrupt_file();
+        remove_agent_at(&path, "alice").expect_err("a corrupt file must not be overwritten");
+        assert_eq!(std::fs::read(&path).expect("read"), TRUNCATED.as_bytes());
+    }
+
+    #[test]
+    fn set_groups_keeps_other_agents_entries() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join(TOOL_GROUPS_FILE);
+        set_groups_at(&path, "alice", &["inbox".to_owned()]).expect("set on missing file");
+        set_groups_at(&path, "ruth", &["messaging".to_owned()]).expect("set");
+        let map = crate::agent_config::read_map(&path).expect("read");
+        assert_eq!(map["alice"], vec!["inbox".to_owned()]);
+        assert_eq!(map["ruth"], vec!["messaging".to_owned()]);
+    }
+}