Close the review's gaps round the agent account (hq ADR 0266)

The managed settings apply to every account's claude, so a key-helper script under the
agent's home would run as the operator, and through sudo as root: the command is now
carried whole in the root-owned managed settings and reads the key only as the agent.
The helper reads only a regular file, bounded, without blocking, and a request it does
not answer fails in time instead of holding every later one; a directory entry it
answers that is not a name is refused. The guard's record is matched on its binary in
the query, a half-named agent account is not taken as the operator's, the kept API key
stays until the agent's home holds one, restic refuses to restore beside a directory
others may write, and the agent-home check cleans a path before judging it.

modules/claude-code/cmd/claude-code/guard_run.go

@@ -110,10 +110,12 @@ func recordInJournal(id string, e GuardEntry) error {
 
 // readJournal is the journal's last lines of the guard's record, read as root through the runtime account's
 // sudo where this process is not root: what other accounts said is not the runtime account's to read. As JSON,
-// with the field the journal itself sets for the program that wrote the line (_EXE), which no writer chooses.
+// with the field the journal itself sets for the program that wrote the line (_EXE), which no writer chooses —
+// and matched on it in the query itself, so lines another program wrote under the guard's identifier cannot
+// push the guard's own past the last ones read.
 var readJournal = func(id string, last int) ([]byte, error) {
 	args := []string{"journalctl", "-q", "--no-pager", "-o", "json", "--output-fields=MESSAGE,_EXE", "-t", id,
-		"-n", strconv.Itoa(last)}
+		"_EXE=" + HelperPath(), "-n", strconv.Itoa(last)}
 	if os.Geteuid() != 0 {
 		args = append([]string{"sudo", "-n"}, args...)
 	}