agents: the send(operator) refusal also covers agents without matrix

An agent with no matrix account has no `mcp__matrix__*` tools, so a
refusal that only says "use the matrix MCP tools" points it at something
it cannot call. `OPERATOR_SEND_REFUSAL` now names matrix for an agent
that has it, and tells one without it that there is no direct channel:
the operator reads its `set_status` line, its turn output on the
dashboard, and its logs. The allow-list refusal, the `send` tool
description, the MCP server instructions and the system prompt say
"over matrix if you have it" to match, and the helper-event bullets go
back to "ask the operator" without naming a channel.

hive-agent-mcp/src/send_allow.rs

@@ -44,7 +44,7 @@ pub fn check_send_allowed(to: &str) -> Result<(), String> {
     Err(format!(
         "send refused: recipient '{to}' not in services.hyperhive.agent.allowedRecipients \
          (configured in agent.nix). Allowed: {allow:?}. To reach the operator, use \
-         the matrix MCP tools."
+         the matrix MCP tools if you have them."
     ))
 }
 
@@ -53,9 +53,10 @@ mod tests {
     use super::check_send_allowed;
 
     #[test]
-    fn operator_is_refused_with_the_matrix_pointer() {
+    fn operator_is_refused_naming_matrix_and_the_no_matrix_fallback() {
         let refusal = check_send_allowed(hive_sh4re::manager::OPERATOR_RECIPIENT)
             .expect_err("operator must be refused");
         assert!(refusal.contains("mcp__matrix__"), "{refusal}");
+        assert!(refusal.contains("set_status"), "{refusal}");
     }
 }