feat(#1636): infra_admin capability — restart hive-ci/gateway/forge via restart tool

hive-priv/src/main.rs

@@ -23,7 +23,7 @@ use anyhow::{Context as _, Result, bail};
 use hive_sh4re::priv_proto::{
     AGENT_PREFIX, AGENT_STATE_ROOT, BindMount, JournalQuery, MANAGER_NAME, META_DIR,
     NetworkIsolation, PRIV_SOCK, PrivEvent, PrivRequest, PrivResponse, PrivStream, PrivStreamLine,
-    SIBLING_CONTAINERS,
+    RESTARTABLE_INFRA_CONTAINERS, SIBLING_CONTAINERS,
 };
 use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
 use tokio::net::unix::OwnedWriteHalf;
@@ -250,6 +250,10 @@ async fn exec(req: PrivRequest, writer: &mut OwnedWriteHalf) -> Result<(String,
         PrivRequest::RestartMatrixDaemon { ref agent_name } => {
             restart_matrix_daemon(agent_name).await
         }
+
+        PrivRequest::RestartInfraContainer { ref container } => {
+            restart_infra_container(container).await
+        }
     }
 }
 
@@ -376,6 +380,35 @@ async fn restart_matrix_daemon(agent_name: &str) -> Result<(String, String)> {
     ))
 }
 
+/// `RestartInfraContainer` — restart a hive infrastructure container on
+/// the host via `systemctl restart container@<container>.service`. The
+/// `container` is validated against `RESTARTABLE_INFRA_CONTAINERS` here,
+/// root-side, so this is the authoritative allowlist even though
+/// hive-c0re also gates on the caller's `infra_admin` capability.
+async fn restart_infra_container(container: &str) -> Result<(String, String)> {
+    if !RESTARTABLE_INFRA_CONTAINERS.contains(&container) {
+        bail!("container {container:?} is not a restartable hive infra container");
+    }
+    let unit = format!("container@{container}.service");
+    let out = Command::new("systemctl")
+        .args(["restart", &unit])
+        .output()
+        .await
+        .with_context(|| format!("systemctl restart {unit}"))?;
+    if !out.status.success() {
+        bail!(
+            "systemctl restart {unit} exited {}: {}",
+            out.status,
+            String::from_utf8_lossy(&out.stderr).trim()
+        );
+    }
+    tracing::info!(target: "infra-restart", "restarted {unit}");
+    Ok((
+        String::from_utf8_lossy(&out.stdout).into_owned(),
+        String::from_utf8_lossy(&out.stderr).into_owned(),
+    ))
+}
+
 /// Shared helper for `WriteAgentForgeToken` and `WriteAgentMatrixToken`.
 /// Writes `content` to `AGENT_STATE_ROOT/<agent_name>/state/<filename>`,
 /// chowns to the agent user (derived from the state dir's existing owner),