hive-screen-mcp: bound grim/wtype and VNC calls; hive-c0re: make messages match the code

hive-screen-mcp ran `grim` / `wtype` through an unbounded
`Command::output()` and spoke RFB to neatvnc with no deadline, so a
wedged compositor or a VNC server that accepts and never speaks held the
agent's turn forever. Each subprocess now has a 30s limit and is killed
when it hits it; each RFB exchange has a 10s limit. Both come back to the
agent as the tool's text result, like every other failure in this crate.

hive-c0re operator-facing text that described behaviour the code lacks:
- `hivectl matrix reset-password` printed a "next: hivectl matrix
  create-user" hint that fails for every target (agents are refused, a
  non-agent hits M_USER_IN_USE). The line is gone.
- a failed `nixos-container update` appended the container's journal
  tail, read with `journalctl -M`. Since the job DAG, `update` only runs
  from the `Swap` node on a stopped container, so the read always came
  back empty. The helper is removed; the error still points at the
  build log.
- the matrix sweep comment in main.rs said it re-provisions agent token
  files; `ensure_all` creates no agent accounts or tokens.
- the knowledge-pull comments named a webhook caller that no longer
  exists and claimed a race was "fixed at its source".
- `handle_spawn`'s doc and the `mcp_sockets` module doc named callers of
  `register_agent` / a rollback that do not exist.

Refs #4723

hive-c0re/src/workers/knowledge.rs

@@ -111,9 +111,8 @@ pub async fn pull(coord: &Coordinator) -> Result<()> {
     // `LOCAL_DIR` after the initial clone — this working tree exists to mirror
     // `origin/main`, not to be edited in place. A tracked file left dirty
     // by any other means (a stray manual edit on the host, an interrupted
-    // prior operation, or — the actual root cause here — two unsynchronized
-    // boot-time pull callers racing on this same working tree, since fixed
-    // in `main.rs`) would otherwise abort the `--ff-only` merge below with
+    // prior operation, or two pulls running on this working tree at once)
+    // would otherwise abort the `--ff-only` merge below with
     // "local changes would be overwritten"; an untracked file left behind
     // the same ways aborts it with "untracked working tree files would be
     // overwritten" instead — same wedge, just `clean`'s failure message