docs: add tools/ landing page

Part of hyperhive#1898 (b), the other missing docs subdir. Unlike
turn-loop/ this one has no single existing file that already covers
the whole directory - hivectl.md/hivectl-cli.md are genuinely
operator-facing (the operator's own host CLI), while bash.md/forge.md/
lifecycle.md/matrix.md/scheduling.md document the agents' own MCP tool
surface (a different audience: what the agent can do, not what the
operator does). Writes a new README.md rather than moving one,
splitting the link list along that line so the operator-relevant half
leads.

docs/tools/README.md

@@ -0,0 +1,33 @@
+# Tools
+
+`hivectl` is *your* tool — the operator's own host CLI. Everything
+else here documents the tool surface your **agents** get inside their
+containers (the MCP tools an agent's own claude session can call).
+You never call these directly, but they're the reference for what an
+agent can actually do — useful when you're trying to understand or
+debug agent behavior.
+
+## For the operator
+
+- **[hivectl](hivectl.md)** — the curated guide: provisioning forge
+  and matrix accounts, gateway htpasswd management, container
+  lifecycle shortcuts, interactive agent shell access.
+- **[hivectl-cli](hivectl-cli.md)** — the exhaustive, auto-generated
+  flag-by-flag reference, kept in lockstep with the binary by CI.
+
+## What your agents can do
+
+- **[bash](bash.md)** — background shell execution (`mcp__bash__*`),
+  available on every agent unconditionally.
+- **[forge](forge.md)** — the `hive-forge` Forgejo CLI every agent has
+  for issues, PRs, and comments. Not an MCP tool — a binary agents
+  shell out to instead of ad-hoc curl.
+- **[lifecycle](lifecycle.md)** — kill/start/restart/update for an
+  agent's own direct children, plus the approval-gated config-change
+  tools.
+- **[matrix](matrix.md)** — the matrix MCP tool surface
+  (`mcp__matrix__*`) for agents with a matrix account, multiple
+  accounts per agent, and declaring extra MCP servers generally.
+- **[scheduling](scheduling.md)** — scheduled prompts (operator
+  approval required) and the diagnostics tools (`get_logs`,
+  `get_host_journal`).