swarm-nats-auth: limit agent subscribe to its own inbox and input

An agent's queue credential could subscribe to every subject in the swarm
account, so any agent could read every other agent's terminal, turn state,
operator input and request replies. Agents are the least trusted clients
on the queue (mara's ruling on #4901), so their grants now carry a
subscribe allow-list:

- an agent's own credential (the harness and its subagent daemon):
  `_INBOX.agent.<agent>.>` and `$SWARM.input.<agent>`
- the hive's shared agent client: `_INBOX.client.<client-id>.>`

Hive and swarm-controller grants are unchanged (no `sub` claim, so still
every subject).

The clients connect with the matching inbox prefix, so the replies they
rely on still arrive: the icon write's JetStream ack and the schedule
DIRECT.GET. `connect_with_token` takes the agent name and sets the prefix
itself; the hive-shared fallback uses the new
`connect_with_inbox_prefix`.

The harness no longer subscribes to its input subject when it fell back
to the hive's shared client: that identity names no agent, so it cannot
be granted one agent's input without all of them. It logs that and
skips, the same as the schedule reader on that path.

Refs #4901

hive-subagent-mcp/src/swarm_term.rs

@@ -228,7 +228,8 @@ impl StoreSource {
 async fn connect(target: &Arc<Target>) -> anyhow::Result<async_nats::Client> {
     let url = target.url.clone();
     let target = Arc::clone(target);
-    swarm_queue_client::connect_with_token(&url, None, move || {
+    let agent = target.agent.clone();
+    swarm_queue_client::connect_with_token(&url, None, &agent, move || {
         let target = Arc::clone(&target);
         // Spawned so the future handed back is only a `JoinHandle`, which is
         // `Sync` as async-nats's auth callback requires; the store read is not.