admit: give an agent her own uid through one writer

souveraine-admit creates or adopts one account via systemd-sysusers, writes
the root-owned mapping health reads, and reports what NSS says afterwards
instead of what it asked for. An account belongs to one agent: handing
annie's to souvie is refused in both directions, as is adopting a uid >=1000.
Binding is by SeedID, not the UUID filename — a mismatch is identity-drift.

Cargo.toml

@@ -211,6 +211,13 @@ required-features = ["secrets"]
 name = "souveraine-machined"
 path = "src/bin/souveraine-machined.rs"
 
+# The admission executor. Root-only, no feature gate, no daemon: agents get
+# their Unix principal through exactly one writer, and admission is a rare
+# deliberate ceremony rather than something a background service does.
+[[bin]]
+name = "souveraine-admit"
+path = "src/bin/souveraine-admit.rs"
+
 [[bin]]
 name = "souveraine-sessiond"
 path = "src/bin/souveraine-sessiond.rs"