hive-screen-mcp: bound grim/wtype and VNC calls; hive-c0re: make messages match the code

hive-screen-mcp ran `grim` / `wtype` through an unbounded
`Command::output()` and spoke RFB to neatvnc with no deadline, so a
wedged compositor or a VNC server that accepts and never speaks held the
agent's turn forever. Each subprocess now has a 30s limit and is killed
when it hits it; each RFB exchange has a 10s limit. Both come back to the
agent as the tool's text result, like every other failure in this crate.

hive-c0re operator-facing text that described behaviour the code lacks:
- `hivectl matrix reset-password` printed a "next: hivectl matrix
  create-user" hint that fails for every target (agents are refused, a
  non-agent hits M_USER_IN_USE). The line is gone.
- a failed `nixos-container update` appended the container's journal
  tail, read with `journalctl -M`. Since the job DAG, `update` only runs
  from the `Swap` node on a stopped container, so the read always came
  back empty. The helper is removed; the error still points at the
  build log.
- the matrix sweep comment in main.rs said it re-provisions agent token
  files; `ensure_all` creates no agent accounts or tokens.
- the knowledge-pull comments named a webhook caller that no longer
  exists and claimed a race was "fixed at its source".
- `handle_spawn`'s doc and the `mcp_sockets` module doc named callers of
  `register_agent` / a rollback that do not exist.

Refs #4723

hive-c0re/src/server.rs

@@ -287,8 +287,8 @@ async fn dispatch(req: &HostRequest, coord: Arc<Coordinator>) -> HostResponse {
     }
 }
 
-/// Create + start the container for `name`, rolling back socket
-/// registration and notifying the manager on failure.
+/// Create + start the container for `name` and bind its MCP listener. On a
+/// failed spawn nothing was registered: post a swarm notice and return the error.
 async fn handle_spawn(coord: &Arc<Coordinator>, name: &str) -> Result<HostResponse> {
     tracing::info!(%name, "spawn");
     let agent_dir = crate::paths::agent_runtime_dir(name);
@@ -762,7 +762,6 @@ async fn handle_matrix_reset_password(name: &str) -> Result<HostResponse> {
     Ok(HostResponse::messages(vec![
         format!("matrix: password for @{name}:{server_name} reset"),
         format!("password persisted at: {}", pw_path.display()),
-        format!("next: hivectl matrix create-user {name}   # mints a fresh access token"),
     ]))
 }