fix: route forge/matrix token writes through hive-priv

hive-c0re runs as the unprivileged hive-core user (privsep from #702)
and cannot write to agent-owned state directories. forge-token and
matrix-token writes were failing with EACCES on every startup sweep.

Add WriteAgentStateFile to PrivRequest: hive-priv (root) writes the
file 0600 and chowns it to the agent user so the agent can read it.

- hive-sh4re: add AGENT_STATE_ROOT constant + WriteAgentStateFile variant
- hive-priv: validate agent name + filename (no traversal), write via root
- priv_client: add write_agent_state_file helper
- forge: mint_and_persist_token routes agent paths through priv
- matrix: ensure_user_for routes matrix-token through priv

Closes #1257

hive-c0re/src/priv_client.rs

@@ -256,6 +256,22 @@ pub async fn run_forge_admin(args: &[&str]) -> Result<(String, String)> {
     check(call(&PrivRequest::RunForgeAdmin { args: owned }).await?)
 }
 
+/// Write `content` to `<agent_state_root>/<agent_name>/state/<filename>`
+/// via hive-priv (running as root). The file is written 0600 and chowned
+/// to the agent user so it is readable from inside the agent container.
+///
+/// Used for credential files (forge-token, matrix-token) that hive-c0re
+/// mints but cannot write directly because those paths are inside agent-
+/// owned (0755) state directories and hive-c0re runs unprivileged.
+pub async fn write_agent_state_file(agent_name: &str, filename: &str, content: &str) -> Result<()> {
+    ok(call(&PrivRequest::WriteAgentStateFile {
+        agent_name: agent_name.to_owned(),
+        filename: filename.to_owned(),
+        content: content.to_owned(),
+    })
+    .await?)
+}
+
 fn check(resp: PrivResponse) -> Result<(String, String)> {
     if resp.ok {
         Ok((resp.stdout, resp.stderr))