fix(hivectl): ask the daemon whether an agent exists

The agents root is 0700 and owned by the daemon's user, so hivectl's
client-side existence guard hit EACCES on traversal for anyone not root.
It reported that as "this command needs root; re-run with sudo", which
turned three verbs' pre-flight check into a permission error about the
wrong thing: `choom`, `subvol upgrade` and `subvol snapshot create` all
failed at the guard rather than at whatever they actually needed.

The daemon runs as the owning user and already answers this question for
its own provisioning paths, so expose it on the host socket as
`AgentExists` and have hivectl ask. Operators reach that socket through
the `hive-admin` group, so the guard now works without sudo.

`choom` still needs root for `machinectl shell` — we ship no polkit rule
granting those actions — so it now checks the effective uid and says so
directly instead of failing later inside systemd's authorisation.

hivectl/src/subvol.rs

@@ -52,7 +52,7 @@ pub(crate) async fn dispatch_subvol(socket: &Path, cmd: SubvolCmd) -> Result<()>
 }
 
 async fn subvol_upgrade(socket: &Path, name: &str, yes: bool) -> Result<()> {
-    if !agent_exists(name)? {
+    if !agent_exists(socket, name).await? {
         bail!("no agent named {name:?} (no state dir under the agents root)");
     }
     if !yes {
@@ -151,7 +151,7 @@ async fn subvol_upgrade(socket: &Path, name: &str, yes: bool) -> Result<()> {
 /// enforces the same rules server-side, so this check is
 /// belt-and-suspenders (fail fast client-side with a clear message).
 async fn subvol_snapshot_create(socket: &Path, name: &str, label: String) -> Result<()> {
-    if !agent_exists(name)? {
+    if !agent_exists(socket, name).await? {
         bail!("no agent named {name:?} (no state dir under the agents root)");
     }
     if !label.starts_with("hive-") {