docs: move the cli references under 2-handbook/tools

Closes #6157

AGENTS.md

@@ -33,8 +33,8 @@ nix fmt        # treefmt is the CI gate, NOT bare cargo fmt
 
 Changed a `hivectl` / `swarmctl` verb or flag? Regenerate its doc — only
 CI's `nix flake check` catches the drift:
-`nix develop -c cargo run --bin hivectl -- markdown-docs > docs/2-handbook/reference/hivectl-cli.md`
-(same for `swarmctl` → `docs/2-handbook/reference/swarmctl-cli.md`). CI red but local
+`nix develop -c cargo run --bin hivectl -- markdown-docs > docs/2-handbook/tools/hivectl-cli.md`
+(same for `swarmctl` → `docs/2-handbook/tools/swarmctl-cli.md`). CI red but local
 green → build the suspect check (e.g. `nix build
 .#checks.x86_64-linux.hivectl-docs`) before blaming the builder.
 
@@ -58,7 +58,7 @@ Per-hive (host + in-container):
   crate.
 - **`hivectl/`** — operator CLI; talks to `hive-c0re` over the host admin
   socket, does NOT link it. Verb reference (CI-enforced):
-  [`docs/2-handbook/reference/hivectl-cli.md`](docs/2-handbook/reference/hivectl-cli.md).
+  [`docs/2-handbook/tools/hivectl-cli.md`](docs/2-handbook/tools/hivectl-cli.md).
 - **`hive-priv/`** — minimal root helper, socket-activated at
   `/run/hive/priv.sock`; the few root ops (bind-mount edits, nsenter)
   `hive-c0re` delegates. See `docs/2-handbook/trust-boundary/boundary.md`.
@@ -130,7 +130,7 @@ Swarm-level:
   **`users.yml` in place**, shared with `swarm-authelia-bridge`; that
   crate's README says what both writers must uphold. Verb reference
   (CI-enforced):
-  [`docs/2-handbook/reference/swarmctl-cli.md`](docs/2-handbook/reference/swarmctl-cli.md).
+  [`docs/2-handbook/tools/swarmctl-cli.md`](docs/2-handbook/tools/swarmctl-cli.md).
 - **`swarm-authelia-bridge/`** (+ **`swarm-authelia-bridge-sock/`** wire
   types) — the other writer of authelia's users DB; runs inside
   `swarm-authelia`.