docs: move privsep socket-activation + child-state rw rationale out of code comments

docs/persistence.md

@@ -220,6 +220,20 @@ Under `/var/lib/hyperhive/agents/<name>/`:
   - `hyperhive-turn-stats.sqlite` — per-turn timing stats.
   - `hyperhive-model` — single-line model name override file.
 
+### Parent access to child state
+
+A parent agent gets each direct child's `state`, `harness`, and
+`config` dirs bind-mounted **read-write** (`bind_child_agent_dirs` in
+`lifecycle.rs`). The RW on `state` is deliberate, not an oversight: a
+parent manages its children, which includes writing into a child's
+state for recovery (e.g. seeding notes, clearing a stuck sentinel) as
+well as reading it. `config` is RW because the parent authors proposed
+config changes for the child (the approval flow commits into the
+child's config repo), and `harness` is RW for the same management
+reasons. Per-child isolation still holds: a container only ever has
+its *own* dirs plus its direct children's bind-mounted, never a
+sibling's.
+
 Under `/var/lib/hyperhive/applied/<name>/` — the hive-c0re-only
 applied repo. Tracks `flake.nix` (module-only boilerplate; never
 edited after first spawn) + `agent.nix` (the actual config; the