agent (unreleased): fixes after an independent review — one lock for the writers of agent.json, the trust run serialised and bounded, the CA copy keeps its previous root, the profile stanza from the wrapper's answer, a stale give-up ends, both boot tokens from one read

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

internal/localapi/disks_test.go

@@ -467,6 +467,9 @@ func (f *fakeGuestAttacher) AttachDrive(_ context.Context, _ int, where string)
 func (f *fakeGuestAttacher) GuestSeesMount(_ context.Context, _ int, _ string) bool { return true }
 func (f *fakeGuestAttacher) GuestBootID(_ context.Context, _ int) string            { return "boot-1" }
 func (f *fakeGuestAttacher) GuestBootKey(_ context.Context, _ int) string           { return "key-1" }
+func (f *fakeGuestAttacher) GuestBootTokens(_ context.Context, _ int) (string, string) {
+	return "boot-1", "key-1"
+}
 func (f *fakeGuestAttacher) attachDriveCount() int {
 	f.mu.Lock()
 	defer f.mu.Unlock()