feat(#2641): sudoless hivectl via a hive-admin group on the host socket

The host admin socket `/run/hyperhive/host.sock` was `0660 root:root` (no
SocketGroup), so hivectl needed sudo. Group-own it by a new `hive-admin`
group and add a `services.hyperhive.c0re.adminUsers` allowlist: listed users
join `hive-admin` and drive hivectl without root.

- `SocketGroup = "hive-admin"`, `SocketMode = "0660"` on the hive-c0re.socket
  unit.
- `/run/hyperhive` -> `0751` (traverse-only, no listing) so the group can reach
  the socket path; the socket's own `0660 hive-admin` mode gates the
  connection, and the per-agent subdirs keep their own restrictive perms.
- Empty `adminUsers` (the default) leaves `hive-admin` memberless -> root-only,
  as before.

The admin socket is full hive control (spawn/kill/destroy/deploy), so
`adminUsers` is an explicit, opt-in trust grant. Documented in
docs/boundary.md (host admin socket access) + docs/tools/hivectl.md.

nix/host-modules/hive-c0re/options.nix

@@ -315,5 +315,22 @@
         serialized by its lifecycle lease regardless.
       '';
     };
+
+    adminUsers = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [ "alice" ];
+      description = ''
+        Login users granted **sudoless `hivectl`**. Each is added to the
+        `hive-admin` group, which group-owns the host admin socket
+        (`/run/hyperhive/host.sock`, mode `0660`) — so listed users drive
+        `hivectl` (and thus the whole hive) without `sudo`.
+
+        This is a real privilege grant: the admin socket is *full* hive
+        control — spawn / kill / destroy / deploy — see `docs/boundary.md`.
+        Keep the list to trusted operators. Empty (the default) keeps the
+        socket root-only, as before.
+      '';
+    };
   };
 }