* feat(managed-agent): let the bootstrap set the service account and MySQL up
With --service-user, run as root, the bootstrap writes the systemd
layout's files with their final owners and modes: the account owns
harness.env and application.yml, server.env is 0640 root:<group>, and a
new directory is 0750 root:<group>. It refuses an unknown account, a
malformed name, a non-root run, or a directory path the account cannot
enter, before writing anything. server.env records the account as
QWEN_MANAGED_AGENT_SERVICE_USER.
The bootstrap also generates the database password and writes
mysql-setup.sql, readable by root only, which creates the database and
the qwen account for localhost and 127.0.0.1 with the performance_schema
grant, and fails rather than changing an existing database or account.
Preflight gains a service-user row, and the config and credentials rows
check access as that account, including every directory above the file,
so a root --check reports a file the service cannot read.
* fix(managed-agent): check service-account access along symbolic links
Both access checks judged directories from one side of a symbolic link
only. Preflight resolved the file's real path first, so it skipped the
directories on the way to the link: a link in a root-only 0700 directory
passed although the account cannot enter that directory. The bootstrap
stat'ed through the link but walked up the path as given, so it skipped
the directories above the link's target: a configuration directory
linked under a root-only 0700 directory passed, and the bootstrap wrote
files the service could not read.
Both now walk the path the way the kernel resolves it, one name at a
time, following each link's target, and check every directory they look
a name up in. More than 40 links count as a loop, as ELOOP does.
Shaojin Wen
9c0414ab42