hive-c0re: scope list_schedules to what the requester can actually act on

handle_list_schedules took no requester and returned every schedule
unfiltered, unlike cancel_schedule/edit_schedule/fire_schedule_now
which all gate on the shared ownership predicate (self, operator, or
subtree via topology::is_descendant_of). list_schedules now filters
through the same predicate, renamed cancel_authorized ->
schedule_authorized since it backs all four verbs now, not just
cancel.

Fixed five stale 'every schedule' / 'unfiltered' claims found while in
here: filter_ghost_schedule_targets's doc comment, the list_schedules
MCP tool description, docs/tools/scheduling.md's per-verb section
(already self-contradicting its own top-of-file subtree-scoping claim
before this fix), and hive-core-agent-sock's ListSchedules/Schedules
wire-type doc comments (including a stale '(privileged)' marker from
the pre-topology-subtree model).

Credit to atlas: independently found the same fix while finishing
PR #4233 (which documents this bug per mara's 'fix it, don't document
it' ruling) and caught two stale doc spots I'd missed
(hive-core-agent-sock's comments) plus proposed the
schedule_authorized rename. Compared diffs directly before either of
us pushed; he dropped his scheduling.rs changes so we didn't collide.

fixes #4237

hive-c0re/src/socket_server/mod.rs

@@ -633,7 +633,7 @@ async fn dispatch_orchestration(req: &Request, agent: &str, coord: &Arc<Coordina
             if let Some(err) = require_group(agent, "scheduling", "list schedules") {
                 return err;
             }
-            handle_list_schedules(coord)
+            handle_list_schedules(coord, agent)
         }
         Request::FireScheduleNow { id } => {
             if let Some(err) = require_group(agent, "scheduling", "fire a schedule") {

hive-c0re/src/socket_server/schedules.rs

@@ -10,11 +10,20 @@ use hive_core_agent_sock::Response;
 
 use crate::coordinator::Coordinator;
 
-/// `ListSchedules` — snapshot every scheduled prompt onto the wire.
-pub(super) fn handle_list_schedules(coord: &Arc<Coordinator>) -> Response {
+/// `ListSchedules` — snapshot the scheduled prompts `requester` is
+/// authorized to see: its own schedules, ones owned by an agent in its
+/// subtree, or (for the operator) everything. Uses the same
+/// `schedule_authorized` rule `CancelSchedule`/`EditSchedule`/
+/// `FireScheduleNow` already enforce, applied here as a per-row filter
+/// instead of a hard reject.
+pub(super) fn handle_list_schedules(coord: &Arc<Coordinator>, requester: &str) -> Response {
     match coord.scheduled_prompts.list() {
         Ok(schedules) => Response::Schedules {
-            schedules: schedules.into_iter().map(schedule_to_wire).collect(),
+            schedules: schedules
+                .into_iter()
+                .filter(|s| schedule_authorized(requester, &s.owner))
+                .map(schedule_to_wire)
+                .collect(),
         },
         Err(e) => Response::Err {
             message: format!("list scheduled prompts: {e:#}"),
@@ -115,7 +124,7 @@ pub(super) fn handle_cancel_schedule(
             };
         }
     };
-    if !cancel_authorized(requester, &schedule.owner) {
+    if !schedule_authorized(requester, &schedule.owner) {
         return Response::Err {
             message: format!(
                 "not authorized: {requester} cannot cancel schedule owned by {owner}",
@@ -165,7 +174,7 @@ pub(super) async fn handle_fire_schedule_now(
             };
         }
     };
-    if !cancel_authorized(requester, &schedule.owner) {
+    if !schedule_authorized(requester, &schedule.owner) {
         return Response::Err {
             message: format!(
                 "not authorized: {requester} cannot fire schedule owned by {owner}",
@@ -239,7 +248,7 @@ pub(super) fn handle_edit_schedule(
             };
         }
     };
-    if !cancel_authorized(requester, &schedule.owner) {
+    if !schedule_authorized(requester, &schedule.owner) {
         return Response::Err {
             message: format!(
                 "not authorized: {requester} cannot edit schedule owned by {owner}",
@@ -266,21 +275,22 @@ pub(super) fn handle_edit_schedule(
     }
 }
 
-/// Permission check for `CancelSchedule` on the manager surface.
-/// `requester` (always `ruth` here) can cancel its own schedules.
-/// Sub-agent ownership is delegated to topology — see
-/// `crate::topology::is_descendant_of`. Also reused by
-/// `handle_fire_schedule_now` — fire-auth follows the same shape.
-fn cancel_authorized(requester: &str, owner: &str) -> bool {
+/// Permission check shared by the whole scheduling surface: `requester`
+/// can act on a schedule it owns, on one owned by an agent in its
+/// subtree (delegated to topology — see `crate::topology::is_descendant_of`),
+/// or, as the operator, on anything. `CancelSchedule`/`EditSchedule`/
+/// `FireScheduleNow` apply it as a hard reject; `ListSchedules` applies
+/// it as a per-row filter.
+fn schedule_authorized(requester: &str, owner: &str) -> bool {
     if requester == owner {
         return true;
     }
     if requester == hive_sh4re::manager::OPERATOR_RECIPIENT {
         return true;
     }
-    // Manager can cancel anything owned by an agent in its subtree.
-    // For the current single-manager topology that covers everything,
-    // but the check stays correct as the tree grows.
+    // Manager can act on anything owned by an agent in its subtree. For
+    // the current single-manager topology that covers everything, but
+    // the check stays correct as the tree grows.
     crate::topology::is_descendant_of(owner, requester)
 }
 
@@ -302,11 +312,12 @@ pub fn schedule_to_wire_public(
 /// last `nixos-container list` scan (stopped agents included, destroyed
 /// ones absent); the `operator` pseudo-target is always retained since
 /// it isn't a container. Applied only to the dashboard wire paths
-/// (`api_schedules` + the `SchedulesChanged` SSE emit) — the
-/// manager-facing `list_schedules` stays unfiltered so agents can still
-/// see and cancel stale targets. This is a view filter: the underlying
-/// schedule rows keep every target, so a re-spawned agent's targets
-/// reappear on their own.
+/// (`api_schedules` + the `SchedulesChanged` SSE emit) — `list_schedules`
+/// doesn't apply this filter (it still returns every live target, ghost
+/// or not, on the schedules the requester is authorized to see) so an
+/// agent can still see and cancel its own stale targets. This is a view
+/// filter: the underlying schedule rows keep every target, so a
+/// re-spawned agent's targets reappear on their own.
 pub(crate) fn filter_ghost_schedule_targets(
     schedules: &mut [hive_sh4re::schedule::WireSchedule],
     live: &std::collections::HashSet<String>,
@@ -379,6 +390,32 @@ mod tests {
         }
     }
 
+    #[test]
+    fn schedule_authorized_self_is_true() {
+        // Disk-free branch — never reaches `is_descendant_of`.
+        assert!(schedule_authorized("iris", "iris"));
+    }
+
+    #[test]
+    fn schedule_authorized_operator_is_true() {
+        // Disk-free branch — never reaches `is_descendant_of`.
+        assert!(schedule_authorized(
+            hive_sh4re::manager::OPERATOR_RECIPIENT,
+            "iris"
+        ));
+    }
+
+    #[test]
+    fn schedule_authorized_unrelated_requester_is_false() {
+        // Control: neither self nor operator, and no on-disk topology in
+        // a test sandbox connects these two names — pins that the
+        // predicate isn't accidentally stuck at `true`.
+        assert!(!schedule_authorized(
+            "definitely-not-the-owner",
+            "also-not-the-requester"
+        ));
+    }
+
     #[test]
     fn ghost_filter_drops_dead_agents_keeps_live_and_operator() {
         let live: std::collections::HashSet<String> = ["iris".to_owned(), "damocles".to_owned()]