swarm-nats-auth: take the subscribe subjects from the shared definitions

The reader's subscribe allow-list spelled `$SWARM.term.*`,
`$SWARM.term.*.sub.*` and `$SWARM.agent-state.*` as literals, copies of
private prefixes in hive-agent and swarm-controller. A rename on either side
left the policy behind and the stream stopped with only a connection-level
server error.

swarm-queue-client now owns `term_subject`, `agent_state_subject` and their
`*_wildcard` forms, and `subagent_term::subject_wildcard`; hive-agent's
publishers, swarm-controller's relays and the policy all build from them.
Subjects are byte-identical.

swarm-controller/src/agent_state_stream.rs

@@ -30,14 +30,6 @@ use futures_util::{Stream, StreamExt as _};
 
 use crate::AppState;
 
-/// Subject family carrying agent turn-state headers — must match
-/// `hive-agent::swarm_agent_state::SUBJECT_PREFIX` exactly, since the two
-/// ends never see the constant together. `crate::term_stream::agent_subject`
-/// spells the full subject; as with the terminal relay's own copy, there is no
-/// way to check the two sides agree short of this comment and the module
-/// docs on both ends staying honest about it.
-const SUBJECT_PREFIX: &str = "$SWARM.agent-state";
-
 #[utoipa::path(
     get,
     path = "/api/agents/{name}/state/stream",
@@ -115,7 +107,7 @@ pub(crate) async fn stream_agent_state(
 
     let subscriber = crate::term_stream::subscribe(
         &client,
-        crate::term_stream::agent_subject(SUBJECT_PREFIX, &agent),
+        swarm_queue_client::agent_state_subject(&agent),
         "state",
     )
     .await?;