docs(#2627): add READMEs for hive-jobq + the socket wire crates

Adds crate READMEs (matching the hive-claude precedent) and wires
readme = "README.md" into each Cargo.toml [package] for hive-jobq,
hive-host-sock, and hive-priv-sock — the crates squarely in the infra
lane. Each README leads with purpose + when-to-use and points at the
crate-root //! docs for depth rather than duplicating them.

First increment of the per-crate-README effort; the shape here is the
proposed template for the remaining crates (see issue discussion).

hive-priv-sock/Cargo.toml

@@ -2,6 +2,7 @@
 name = "hive-priv-sock"
 edition.workspace = true
 version.workspace = true
+readme = "README.md"
 
 [lints]
 workspace = true

hive-priv-sock/README.md

@@ -0,0 +1,21 @@
+# hive-priv-sock
+
+Wire types for the **`hive-priv` privileged-helper socket**
+(`/run/hive/priv.sock`) — the contract between `hive-priv` (the root helper,
+server) and `hive-c0re` (client, via its `priv_client`).
+
+## Why it's its own crate
+
+Split out of `hive-sh4re` so `hive-priv` — a **root-privileged** binary —
+depends on just this narrow protocol crate instead of the much larger
+daemon-shared crate. Two wins: fewer dependencies in a root process's supply
+chain, and a small, self-contained interface makes the privilege boundary this
+crate encodes easier to audit. Mirrors `hive-host-sock`'s split for the host
+admin socket.
+
+## Shape
+
+Serde-derived request/response types only — no server or client logic. Both
+sides import them so the shapes stay in sync. See `docs/boundary.md` +
+`docs/security.md` for the privilege boundary these types sit on, and
+`hive-priv/README` for the helper itself.