swarm-controller: refuse new agents named hive-<anything>

`hive-<hive>` is each hive's read-only forge account, and an agent's forge
account takes the agent's name, so an agent called `hive-<x>` would claim
hive `<x>`'s account. `hive_types::reserved_agent_prefix_violation` names
the rule, and `broken_name_rules` applies it, so both creation paths that
go through it (`POST /api/agents` and placing an undeclared agent on a
hive) refuse such a name for a new agent. An agent already in the roster
keeps its name with a warning, as for every other naming rule.

The email check between hive and agent accounts stays as the second
guard, for agents created before this rule.

Refs #4851

swarm-controller/src/forge/hive_token.rs

@@ -10,9 +10,12 @@
 //! token the forge still lists with the same last eight characters and scopes
 //! is kept, and a pass whose reads fail queues nothing.
 //!
-//! ⚠️ The account name is not reserved: an agent may be called `hive-<x>`.
-//! Each side refuses an account carrying the other's email, so neither ever
-//! locks down, joins the team with, or mints a token for the other's account.
+//! A new agent may not be called `hive-<x>`
+//! (`hive_types::reserved_agent_prefix_violation`, checked at agent creation),
+//! which is the primary guard against an agent claiming a hive's account. An
+//! agent created before that rule can still hold such a name, so each side
+//! also refuses an account carrying the other's email: neither ever locks
+//! down, joins the team with, or mints a token for the other's account.
 
 use std::sync::Arc;
 

swarm-controller/src/main.rs

@@ -1882,6 +1882,9 @@ fn broken_name_rules(
             "agent name {agent:?} {rule}: the forge refuses it as a username"
         ));
     }
+    if let Some(rule) = hive_types::reserved_agent_prefix_violation(agent) {
+        broken.push(format!("agent name {agent:?} {rule}"));
+    }
     broken
 }
 
@@ -3892,6 +3895,32 @@ mod tests {
         }
     }
 
+    /// The `hive-` prefix belongs to hives' forge accounts, so a new agent
+    /// may not take it. `hivemind` and `xhive-y` are the control.
+    #[test]
+    fn a_new_agent_with_the_hive_prefix_is_refused() {
+        let raw = nix_reserved();
+        let mut warnings = Vec::new();
+        let broken = super::broken_name_rules("hive-x", Some(&raw), &mut warnings);
+        let err =
+            super::name_verdict("hive-x", &broken, Ok(false), &mut warnings).expect_err("hive-x");
+        assert!(err.contains("reserved for hive forge accounts"), "{err}");
+        for ok in ["hivemind", "xhive-y"] {
+            let broken = super::broken_name_rules(ok, Some(&raw), &mut warnings);
+            assert!(broken.is_empty(), "{ok:?}: {broken:?}");
+        }
+        assert!(warnings.is_empty(), "{warnings:?}");
+    }
+
+    /// The prefix the rule reserves is the one hive accounts are named with.
+    #[test]
+    fn the_reserved_prefix_is_the_hive_account_prefix() {
+        assert!(
+            swarm_secret_client::forge::hive_login("alpha")
+                .starts_with(hive_types::RESERVED_AGENT_PREFIX)
+        );
+    }
+
     /// Re-creating an agent under its own name must keep working: a name
     /// already in the roster is warned about, never refused.
     #[test]