hive-c0re: scope list_schedules to what the requester can actually act on

handle_list_schedules took no requester and returned every schedule
unfiltered, unlike cancel_schedule/edit_schedule/fire_schedule_now
which all gate on the shared ownership predicate (self, operator, or
subtree via topology::is_descendant_of). list_schedules now filters
through the same predicate, renamed cancel_authorized ->
schedule_authorized since it backs all four verbs now, not just
cancel.

Fixed five stale 'every schedule' / 'unfiltered' claims found while in
here: filter_ghost_schedule_targets's doc comment, the list_schedules
MCP tool description, docs/tools/scheduling.md's per-verb section
(already self-contradicting its own top-of-file subtree-scoping claim
before this fix), and hive-core-agent-sock's ListSchedules/Schedules
wire-type doc comments (including a stale '(privileged)' marker from
the pre-topology-subtree model).

Credit to atlas: independently found the same fix while finishing
PR #4233 (which documents this bug per mara's 'fix it, don't document
it' ruling) and caught two stale doc spots I'd missed
(hive-core-agent-sock's comments) plus proposed the
schedule_authorized rename. Compared diffs directly before either of
us pushed; he dropped his scheduling.rs changes so we didn't collide.

fixes #4237

hive-c0re/src/socket_server/mod.rs

@@ -633,7 +633,7 @@ async fn dispatch_orchestration(req: &Request, agent: &str, coord: &Arc<Coordina
             if let Some(err) = require_group(agent, "scheduling", "list schedules") {
                 return err;
             }
-            handle_list_schedules(coord)
+            handle_list_schedules(coord, agent)
         }
         Request::FireScheduleNow { id } => {
             if let Some(err) = require_group(agent, "scheduling", "fire a schedule") {