feat(#2641): sudoless hivectl via a hive-admin group on the host socket

The host admin socket `/run/hyperhive/host.sock` was `0660 root:root` (no
SocketGroup), so hivectl needed sudo. Group-own it by a new `hive-admin`
group and add a `services.hyperhive.c0re.adminUsers` allowlist: listed users
join `hive-admin` and drive hivectl without root.

- `SocketGroup = "hive-admin"`, `SocketMode = "0660"` on the hive-c0re.socket
  unit.
- `/run/hyperhive` -> `0751` (traverse-only, no listing) so the group can reach
  the socket path; the socket's own `0660 hive-admin` mode gates the
  connection, and the per-agent subdirs keep their own restrictive perms.
- Empty `adminUsers` (the default) leaves `hive-admin` memberless -> root-only,
  as before.

The admin socket is full hive control (spawn/kill/destroy/deploy), so
`adminUsers` is an explicit, opt-in trust grant. Documented in
docs/boundary.md (host admin socket access) + docs/tools/hivectl.md.

docs/tools/hivectl.md

@@ -1,7 +1,12 @@
 # hivectl
 
 `hivectl` is the operator-facing host CLI for hyperhive. It lives on the
-host (not inside any container) and requires root for most operations.
+host (not inside any container). It talks to `hive-c0re` over the host
+admin socket `/run/hyperhive/host.sock`, which is root-only by default —
+so it needs `sudo` unless you grant sudoless access by listing your
+login user in `services.hyperhive.c0re.adminUsers` (adds you to the
+`hive-admin` group that owns the socket; see
+[`docs/boundary.md`](../boundary.md#host-admin-socket-access-hivectl)).
 Available via the `hive-c0re` package in the host NixOS config.
 
 Unlike the `hive-c0re` daemon subcommands (which go through the broker),