docs: put swarm-controller in the repo map and the swarm doc

The crate was a workspace member with no entry in CLAUDE.md, which is the
index that auto-loads into every turn -- a member missing from it is
invisible to everyone who comes after.

Both entries carry the socket-directory constraint rather than just
naming the daemon, because that is the one thing about this service a
reader can get wrong from a position that looks correct.

CLAUDE.md

@@ -141,6 +141,17 @@ hand-maintained per-file tree drifts out of sync with the code.
   dependency-free wire types.
 - **`hive-metric/`** — small CLI to push a single labeled metric to the
   OTEL collector via the OpenTelemetry Rust SDK / OTLP HTTP exporter.
+- **`swarm-controller/`** — swarm-level daemon, opt-in per host
+  (`services.hyperhive.swarm.controller.enable`). Where `hive-c0re` owns
+  the agents on **one** host, this owns what is true **across** hives; a
+  swarm runs one of them, so most hives leave it off. Serves HTTP over a
+  unix socket (never a TCP port) that the gateway's nginx proxies to.
+  ⚠️ The socket lives in its **own** `RuntimeDirectory`: it is `0666`
+  (nginx is a different user and `connect(2)` needs write), so the
+  containing directory — bind-mounted wholesale into the gateway
+  container — is the only access control there is. Never move it under a
+  directory shared with anything else, `/run/hyperhive` (host admin
+  socket) above all. A unit test pins the path.
 
 ### External dependencies with no directory here