refactor(hivectl): move quota + subvol under agents

Both groups only ever act on a single managed agent's state dir, so
they belong in the `agents` namespace rather than as top-level verbs
next to `forge` / `matrix` / `wg`.

Renames `quota limit` -> `quota set`: the enclosing group already
carries the noun, so the bare verb matches the flat `set-parent` /
`set-limits` spelling without stuttering, and it removes the
`set-limits` (cpu/mem) vs `quota limit` (disk) ambiguity. Adds a
cross-pointer from `set-limits` to `agents quota`.

Handlers stay in their own modules; `run_agents` gains the reparenting
glue. Regenerates docs/tools/hivectl-cli.md.

Refs #2724

hivectl/src/subvol.rs

@@ -1,4 +1,4 @@
-//! `hivectl subvol` — btrfs state-subvolume ops: migrate a plain-dir agent
+//! `hivectl agents subvol` — btrfs state-subvolume ops: migrate a plain-dir agent
 //! state root to a subvolume (`upgrade`), and snapshot create/delete/send.
 
 use std::path::Path;
@@ -28,7 +28,7 @@ fn single_agent_scope(name: &str) -> hive_host_sock::LifecycleScope {
 /// migration via hive-priv, then restart it. The restart is attempted
 /// regardless of the migration outcome so a failed migration never leaves
 /// the agent down; the migration error (if any) is surfaced afterwards.
-/// Route a `hivectl subvol …` subcommand. Split out of `main`'s top-level
+/// Route a `hivectl agents subvol …` subcommand. Split out of `main`'s top-level
 /// match so the CLI router stays within the clippy line budget and the
 /// subvolume-op subcommands are dispatched in one place.
 pub(crate) async fn dispatch_subvol(socket: &Path, cmd: SubvolCmd) -> Result<()> {