swarm-controller: refuse new agents named hive-<anything>

`hive-<hive>` is each hive's read-only forge account, and an agent's forge
account takes the agent's name, so an agent called `hive-<x>` would claim
hive `<x>`'s account. `hive_types::reserved_agent_prefix_violation` names
the rule, and `broken_name_rules` applies it, so both creation paths that
go through it (`POST /api/agents` and placing an undeclared agent on a
hive) refuse such a name for a new agent. An agent already in the roster
keeps its name with a warning, as for every other naming rule.

The email check between hive and agent accounts stays as the second
guard, for agents created before this rule.

Refs #4851

swarm-controller/src/main.rs

@@ -1882,6 +1882,9 @@ fn broken_name_rules(
             "agent name {agent:?} {rule}: the forge refuses it as a username"
         ));
     }
+    if let Some(rule) = hive_types::reserved_agent_prefix_violation(agent) {
+        broken.push(format!("agent name {agent:?} {rule}"));
+    }
     broken
 }
 
@@ -3892,6 +3895,32 @@ mod tests {
         }
     }
 
+    /// The `hive-` prefix belongs to hives' forge accounts, so a new agent
+    /// may not take it. `hivemind` and `xhive-y` are the control.
+    #[test]
+    fn a_new_agent_with_the_hive_prefix_is_refused() {
+        let raw = nix_reserved();
+        let mut warnings = Vec::new();
+        let broken = super::broken_name_rules("hive-x", Some(&raw), &mut warnings);
+        let err =
+            super::name_verdict("hive-x", &broken, Ok(false), &mut warnings).expect_err("hive-x");
+        assert!(err.contains("reserved for hive forge accounts"), "{err}");
+        for ok in ["hivemind", "xhive-y"] {
+            let broken = super::broken_name_rules(ok, Some(&raw), &mut warnings);
+            assert!(broken.is_empty(), "{ok:?}: {broken:?}");
+        }
+        assert!(warnings.is_empty(), "{warnings:?}");
+    }
+
+    /// The prefix the rule reserves is the one hive accounts are named with.
+    #[test]
+    fn the_reserved_prefix_is_the_hive_account_prefix() {
+        assert!(
+            swarm_secret_client::forge::hive_login("alpha")
+                .starts_with(hive_types::RESERVED_AGENT_PREFIX)
+        );
+    }
+
     /// Re-creating an agent under its own name must keep working: a name
     /// already in the roster is warned about, never refused.
     #[test]