fix: derive intent store path from the agent state dir (not LocalAPI.StateDir)

cmd/felhom-agent/main.go

@@ -333,7 +333,11 @@ func runDaemon(cfg config.Config, logger *slog.Logger) int {
 	// state. Gates the watchdog's self-heal re-mount to ENROLLED drives, and the local API records
 	// enroll/eject into it. Open failure → ungated legacy remount (logged) so the daemon still runs.
 	var intentReader storage.IntentReader
-	intentStore, ierr := storage.OpenIntentStore(filepath.Join(cfg.LocalAPI.StateDir, "drive-intents.json"))
+	intentStateDir := "/var/lib/felhom-agent"
+	if cfg.Authz.NonceStorePath != "" {
+		intentStateDir = filepath.Dir(cfg.Authz.NonceStorePath) // share the agent's durable state dir
+	}
+	intentStore, ierr := storage.OpenIntentStore(filepath.Join(intentStateDir, "drive-intents.json"))
 	if ierr != nil {
 		logger.Warn("storage: intent store unavailable — self-heal runs UNGATED (legacy remount-any)", "err", ierr)
 		intentStore = nil