agent (unreleased): fixes after an independent review — one lock for the writers of agent.json, the trust run serialised and bounded, the CA copy keeps its previous root, the profile stanza from the wrapper's answer, a stale give-up ends, both boot tokens from one read

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

internal/localapi/intermediary.go

@@ -324,6 +324,21 @@ func (b *GuestBinder) GuestBootKey(ctx context.Context, vmid int) string {
 	return guestBootKey(hostBootIDFn(), start)
 }
 
+// GuestBootTokens returns both tokens from ONE read of the guest's init: the old token and the key always describe
+// the same moment. Read separately, one could succeed and the other fail (the guest stops between the two) — the
+// controller would then get an old token with no key, read „an older agent”, and recreate every drive-backed app.
+func (b *GuestBinder) GuestBootTokens(ctx context.Context, vmid int) (id, key string) {
+	start := b.guestInitStart(ctx, vmid)
+	if start == "" {
+		return "", ""
+	}
+	bt := hostBtimeFn()
+	if bt == "" {
+		bt = "0"
+	}
+	return bt + "-" + start, guestBootKey(hostBootIDFn(), start)
+}
+
 // guestBootKey joins the two halves; "" when either is missing or the boot_id is not the kernel's shape.
 func guestBootKey(bootID, start string) string {
 	if start == "" || !kernelBootIDRe.MatchString(bootID) {