docs(#2862): document the push side and regenerate the CLI reference

docs/tools/hivectl-cli.md is generated by `hivectl markdown-docs` and
diffed against a fresh run by the hivectl-docs flake check, so adding
the push verb without regenerating it would have failed CI. The
regeneration also retires two copies of a sentence describing the
cross-hive leg as an ssh pipe that "isn't wired up yet" -- ssh was
dropped when the WireGuard mesh became the authentication, and the leg
is wired up now.

snapshot-store.md documented only the receiving host, so a reader had
no way to learn how a pushing hive is told where the store is. It now
covers services.hyperhive.swarm.snapshotStore, including why address
has no default and port does: an address is a deployment fact that
cannot be guessed, a port is a convention both ends read from the same
docs. It also states the namespace rule the two options illustrate --
swarm.* describes the swarm as seen from here, a bare
services.hyperhive.<service> describes a role this host performs.

swarm.md never mentioned the store even though the option lives in its
namespace, so a reader configuring swarm.peers had no signal it exists.

docs/swarm.md

@@ -221,8 +221,22 @@ other side initiates. With keepalive on, the NAT hole stays open.
 If both hosts are behind NAT, a STUN relay or a third host (exit node)
 is required. Out of scope for v0.
 
+## Snapshot store
+
+One further option lives in this namespace but is documented with the
+service it points at: `services.hyperhive.swarm.snapshotStore.{address,
+port}` tells this hive where the swarm's `btrfs receive` endpoint is, so
+`hivectl agent <name> subvol snapshot push` has somewhere to stream to.
+
+It is genuinely swarm-scoped rather than per-peer — a swarm has exactly
+one store, because the receiver keys destinations by *agent* so a
+migrating agent keeps one unbroken incremental chain. See
+[snapshot-store.md](snapshot-store.md).
+
 ## Cross-references
 
+- `docs/snapshot-store.md` — the swarm's `btrfs receive` endpoint, and
+  the `swarm.snapshotStore` option that points a hive at it
 - `docs/conventions.md` § Hive identity — env vars, qualified labels
 - `docs/matrix.md` — matrix federation, TLS cert auto-generation,
   firewall posture