claude-code: write the agent's home as its own account where it has one

On the control node agents are to run as an account that cannot become root
(hq ADR 0266). The runtime keeps running as the operator, so the token, the
identity and the home-scope items go to the agent's home through a helper
started as that account; the licence and the account file follow the move,
what was placed in the operator's home goes once the agent holds the licence,
and the guard refuses every tool of a session running as anyone else,
recording to the journal. An API key is taken only from the agent's home and
only when it is one, here and in the licence manager, so the tool cannot carry
off the runtime's credential. Unchanged where no agent account is named.

modules/claude-code/cmd/claude-code/mesh.go

@@ -258,6 +258,10 @@ func KeepMeshTools(p Paths, m MeshTools) bool {
 // GuardDataOf is what the guard judges with on this machine.
 func GuardDataOf(p Paths, m *MeshTools) GuardData {
 	d := GuardData{Node: p.Node, Log: filepath.Join(p.State, "guard.log"), Machines: []Machine{}, Replacements: []Replacement{}}
+	if p.Confined() {
+		// The session's account cannot write the module's state, and must not rewrite its own record (ADR 0266).
+		d.Agent, d.Log = p.Agent, JournalRecord+GuardJournalID
+	}
 	if m != nil {
 		d.Machines, d.Replacements = m.Machines, m.Replacements
 	}
@@ -314,7 +318,10 @@ func GuardStatus(p Paths, last int) map[string]any {
 			"writing /etc/hosts or /etc/resolv.conf, by the shell or the agent's Edit and Write",
 			"HOSTALIASES, named anywhere in a command",
 			"any command naming " + OverrideVar,
+			"where the machine names an agent account of its own (novox/hq ADR 0266): every command and file edit of a " +
+				"session that does not run as it, whatever it is, and no override lifts it",
 		},
+		"agent_account": map[bool]string{true: p.Agent, false: "none of its own: agents run as the operator's account"}[p.Confined()],
 		"override": OverrideVar + "=<why>, set in the operator's own shell before the session starts; read from the session's " +
 			"environment as it was started, recorded with why, and not honoured when it cannot be recorded",
 		"hook":         GuardCommand(),