refactor(#1834): derive cancel-loose-end privilege from the socket, not the MANAGER_AGENT name

The cancel-loose-end guards (cancel approval / question / reminder)
inferred manager-level privilege by string-matching the canceller
against the hardcoded `hive_sh4re::MANAGER_AGENT` ("ruth"). That laundered
privilege through a name: a request arrives on the privileged manager
socket, gets stamped with the bootstrap agent's name, and the guards
re-derive privilege from that name. Renaming or replacing the bootstrap
agent would then silently move privilege.

Privilege is a property of the SOCKET the request arrived on (the manager
socket is the trust boundary), so thread an explicit `privileged: bool`
through `dispatch_shared` → `handle_cancel_loose_end` → the three guards:

- `Broker::cancel_reminder_as` and `OperatorQuestions::cancel`: the
  `== MANAGER_AGENT` leg becomes `privileged` (owner/asker + operator name
  legs unchanged).
- `check_approval_canceller_is_manager(canceller)` →
  `check_can_cancel_approval(privileged)` (manager-socket-only); unit tests
  updated to assert on the flag.

The manager socket passes `privileged = true`; the agent socket passes
`false`. `MANAGER_AGENT` is still passed as the actor NAME for legitimate
attribution/routing (notifications, schedule ownership, bootstrap
destroy-protection) — those are not privilege checks and are left intact.
Scope is the privilege guards only.

hive-c0re/src/operator_questions.rs

@@ -204,11 +204,18 @@ impl OperatorQuestions {
     /// - the original asker (an agent withdrawing their own ask),
     /// - the operator (already covered by the existing `answer` path
     ///   but allowed here too for symmetry / dashboard cancel),
-    /// - the manager (privileged hive-wide cleanup).
+    /// - a `privileged` caller (one that arrived on the manager socket —
+    ///   privileged hive-wide cleanup; derived from the socket, not a
+    ///   name match).
     ///
     /// Not the target — that's covered by `answer` (responding with
     /// an actual reply, sentinel or otherwise).
-    pub fn cancel(&self, id: i64, canceller: &str) -> Result<(String, String, Option<String>)> {
+    pub fn cancel(
+        &self,
+        id: i64,
+        canceller: &str,
+        privileged: bool,
+    ) -> Result<(String, String, Option<String>)> {
         let conn = self.conn.lock().unwrap();
         let row: Option<(String, String, Option<String>, Option<i64>)> = conn
             .query_row(
@@ -223,9 +230,8 @@ impl OperatorQuestions {
         if answered_at.is_some() {
             bail!("question {id} already answered/cancelled");
         }
-        let authorised = canceller == asker
-            || canceller == hive_sh4re::OPERATOR_RECIPIENT
-            || canceller == hive_sh4re::MANAGER_AGENT;
+        let authorised =
+            privileged || canceller == asker || canceller == hive_sh4re::OPERATOR_RECIPIENT;
         if !authorised {
             bail!("question {id}: '{canceller}' not allowed to cancel (asker = '{asker}')");
         }