Close the review's gaps round the agent account (hq ADR 0266)

The managed settings apply to every account's claude, so a key-helper script under the
agent's home would run as the operator, and through sudo as root: the command is now
carried whole in the root-owned managed settings and reads the key only as the agent.
The helper reads only a regular file, bounded, without blocking, and a request it does
not answer fails in time instead of holding every later one; a directory entry it
answers that is not a name is refused. The guard's record is matched on its binary in
the query, a half-named agent account is not taken as the operator's, the kept API key
stays until the agent's home holds one, restic refuses to restore beside a directory
others may write, and the agent-home check cleans a path before judging it.

modules/claude-code/README.md

@@ -205,8 +205,10 @@ named, and read as the operator's from a controller that sets neither — and ev
 agent goes to that account's home:
 
 - the licence token (`~/.claude/.credentials.json`) and the account it is logged in as (`~/.claude.json`);
-- an API-key licence and its key-helper, in `~/.claude/mesh/`, since the account cannot enter the
-  module's state;
+- an API-key licence, in `~/.claude/mesh/`, since the account cannot enter the module's state. Its key-helper
+  is no script there: the managed settings apply to every account's `claude`, the operator's and root's too,
+  so a script the agent owns would run as them. The managed settings carry the command whole instead, and it
+  reads the key only when run as the agent's account;
 - the items registered at the home scope, recorded per home (`home-placed-<account>.json`).
 
 The runtime's account cannot enter that home (0700, the agent's), so a path under it is touched by a