refactor(#2352): route hivectl github set-token through a daemon wire command

hive-host-sock/src/lib.rs

@@ -158,6 +158,12 @@ pub enum HostRequest {
         #[serde(default)]
         password: Option<String>,
     },
+    /// Write (or overwrite) an agent's GitHub PAT under its state dir, via
+    /// the privileged helper. Daemon-side equivalent of `hivectl github
+    /// set-token`. `token` is resolved + non-empty-validated client-side
+    /// (inline flag or stdin); the daemon just persists it. Read live by
+    /// the agent's `gh` wrapper / git credential helper — no rebuild needed.
+    SetAgentGithubToken { agent: String, token: String },
 }
 
 /// Selects which container classes a hive-wide [`HostRequest::Stop`] /