install: four more hal0-api write paths have no perms.py ownership rows — images/cache, dashboard-layout.json, update-jobs, chat_templates

[thinmintdev]

Surfaced during #1895 (PR #1933) write-path enumeration; deliberately left out of that PR to keep its diff minimal for #1896's rebase.

Paths hal0-api can be first-writer of that have no ownership/mode row in src/hal0/install/perms.py:

• images/cache (api/image_cache.py)
• dashboard-layout.json (dashboard/layout_store.py)
• update-jobs (api/routes/updater.py)
• chat_templates store dir (api/routes/chat_templates.py)

Same O13 birth-ownership class as #1895. PR #1933's new parametrized coverage test (test_every_hal0_api_write_path_has_an_ownership_row) is the durable gate — extend it with these four when adding the rows. Should land after #1896 settles the table.

Refs #1895, #1896.

[thinmintdev]

PR #1933's independent review extended the unrowed-path list beyond the original four. Full known set of hal0-api write paths with no perms.py row (all leave the new coverage test green, since its label list is hand-maintained):

• images/cache (api/image_cache.py)
• dashboard-layout.json (dashboard/layout_store.py:36)
• update-jobs/ (api/routes/updater.py:221)
• chat_templates store dir (api/routes/chat_templates.py)
• gpu_arbiter.json (slots/manager.py:3289)
• stacks/state.json (config/paths.py:490)
• state/agents/*/provision.json
• runner-image-pull-jobs/ (only ever created by User=hal0 today, so not broken — row still worth declaring)

Also from that review, two adjacent items for whoever takes this: (1) the coverage test's docstring over-claims — consider deriving the expected set from code (grep-driven or a registry) instead of a hand list so the NEXT unrowed path actually fails it; (2) PermRow.optional is inert (never read by _expand_row/plan/commit/audit_rows) — either wire it or drop it. Review: #1933 (comment)