c0re: dedupe chown_to_agent into lifecycle (argus #678)

hive-c0re/src/lifecycle.rs

@@ -128,6 +128,23 @@ pub fn agent_uid_gid(agent_name: &str) -> Option<(u32, u32)> {
     None
 }
 
+/// Best-effort `chown(path, agent_uid, agent_gid)`. Resolves the agent's
+/// uid/gid via [`agent_uid_gid`] and shells out to `std::os::unix::fs::chown`.
+/// Silently no-ops when the container isn't built yet (`None` from
+/// [`agent_uid_gid`]) and logs at debug on chown syscall failure — the
+/// activation script in `harness-base.nix` is the steady-state safety
+/// net. Used by per-agent state writers in `forge` + `matrix` so the
+/// agent can read the file without waiting for the next container
+/// rebuild (#673).
+pub fn chown_to_agent(name: &str, path: &Path, subsystem: &str) {
+    let Some((uid, gid)) = agent_uid_gid(name) else {
+        return;
+    };
+    if let Err(e) = std::os::unix::fs::chown(path, Some(uid), Some(gid)) {
+        tracing::debug!(%name, %subsystem, path = %path.display(), error = %e, "chown to agent failed");
+    }
+}
+
 fn validate(name: &str) -> Result<()> {
     if name.is_empty() {
         bail!("agent name must not be empty");