keep the operator list under one key and read it with one direct get

The agent read the operator-profiles bucket with a keys() listing, an
ordered consumer whose grant (STREAM.INFO, CONSUMER.CREATE) and flow-control
reply had never run against a permissioned queue. The controller now writes
the whole list as one JSON array under one key, only when it changed, and
the agent reads it with one DIRECT.GET the way agent_inference::read_own
reads its key. The agent grant shrinks to that one subject.

hive-agent/src/prompt.rs

@@ -81,12 +81,20 @@ fn operators_line(operators: &[OperatorProfile]) -> String {
 /// read within [`OPERATORS_TIMEOUT`]: the prompt then reads as it does with no
 /// operator list.
 async fn operators() -> Vec<OperatorProfile> {
-    within_timeout(OPERATORS_TIMEOUT, async {
-        let client = crate::swarm_queue::client().await;
-        swarm_queue_client::ensure_connected(&client)?;
-        operator_profiles::read_all(&client).await
-    })
-    .await
+    within_timeout(OPERATORS_TIMEOUT, read_operators()).await
+}
+
+/// One read of the operator list over this agent's queue connection.
+async fn read_operators()
+-> std::result::Result<Vec<OperatorProfile>, Box<dyn std::error::Error + Send + Sync>> {
+    let client = crate::swarm_queue::client().await;
+    swarm_queue_client::ensure_connected(&client)?;
+    match operator_profiles::read(&client).await? {
+        operator_profiles::Read::Current(operators) => Ok(operators),
+        operator_profiles::Read::NoBucket => {
+            Err("the operator-profiles bucket does not answer".into())
+        }
+    }
 }
 
 /// `read`'s profiles, or none when it fails or outlasts `timeout`.