broker: resolve <parent> sentinel to topology parent at send time (#692)

hive-ag3nt/src/mcp.rs

@@ -1883,6 +1883,16 @@ fn check_send_allowed(to: &str) -> Result<(), String> {
         // to ask for help.
         return Ok(());
     }
+    if to == hive_sh4re::PARENT_RECIPIENT {
+        // Always allow `<parent>` — same escape-hatch rationale as
+        // the manager exception. The allow-list constrains peer
+        // chatter, not the structural reporting line; the operator
+        // can rewire who the parent IS via `set_parent` without
+        // having to remember to update the per-agent allow-list.
+        // The broker resolves the sentinel to the real parent label
+        // on the host side per topology.json (#692).
+        return Ok(());
+    }
     let Ok(raw) = std::fs::read_to_string(SEND_ALLOW_PATH) else {
         return Ok(()); // file missing → no policy configured → unrestricted
     };