hivectl: add operator-facing host CLI with forge + matrix create-user verbs (#655)

CLAUDE.md

@@ -16,11 +16,24 @@ when you need depth on a subsystem. This file is the index.
 ## File map
 
 ```
-hive-c0re/         host daemon + CLI (one binary, subcommand-dispatched)
-  src/main.rs           clap setup; serve / spawn / kill / rebuild / list /
-                         pending / approve / deny / destroy [--purge] /
-                         request-spawn / set-parent (--parent / --root);
-                         periodic vacuum tasks
+hive-c0re/         host daemon + sibling operator CLI (lib + 2 bins)
+  src/lib.rs            `pub mod` re-exports for every module; shared by
+                         both binaries so they import from the same
+                         tree (no per-bin module duplication).
+  src/main.rs           hive-c0re binary: clap setup; serve / spawn /
+                         kill / rebuild / list / pending / approve /
+                         deny / destroy [--purge] / request-spawn /
+                         set-parent (--parent / --root); periodic
+                         vacuum tasks.
+  src/bin/hivectl.rs    `hivectl` binary (#655): operator-facing host
+                         CLI for ad-hoc administration that doesn't
+                         go through the broker. v0 verbs: `forge
+                         create-user <name>`, `matrix create-user
+                         <name>` — wrap the same idempotent
+                         `forge::ensure_user_for` /
+                         `matrix::ensure_user_for` flows c0re runs
+                         in its boot sweeps, callable manually for
+                         recovery / debug.
   src/server.rs         host admin socket (HostRequest → dispatch)
   src/client.rs         admin-socket client
   src/manager_server.rs manager-privileged socket (ManagerRequest)